merge revision(s) 46416: [Backport #9942]

	* array.c (rb_ary_permutation): `p` is the array of size `r`, as
	  commented at permute0().  since `n >= r` here, buffer overflow
	  never happened, just reduce unnecessary allocation though.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@47331 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 1 insertions, 1 deletions

diff --git a/array.c b/array.c
index edf40c9ee1..5e95e87685 100644
--- a/array.c
+++ b/array.c
@@ -4660,7 +4660,7 @@ rb_ary_permutation(int argc, VALUE *argv, VALUE ary)
 	}
     }
     else {             /* this is the general case */
-	volatile VALUE t0 = tmpbuf(n,sizeof(long));
+	volatile VALUE t0 = tmpbuf(r,sizeof(long));
 	long *p = (long*)RSTRING_PTR(t0);
 	volatile VALUE t1 = tmpbuf(n,sizeof(char));
 	char *used = (char*)RSTRING_PTR(t1);