merge revision(s) 17470:17472:

	* array.c (rb_ary_store, rb_ary_splice): not depend on unspecified
	  behavior at integer overflow.
	* string.c (str_buf_cat): ditto.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8_6@17475 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 3 insertions, 3 deletions

diff --git a/array.c b/array.c
index 000683fda1..c5261044da 100644
--- a/array.c
+++ b/array.c
@@ -370,7 +370,7 @@ rb_ary_store(ary, idx, val)
 	if (new_capa < ARY_DEFAULT_SIZE) {
 	    new_capa = ARY_DEFAULT_SIZE;
 	}
-	else if (new_capa >= ARY_MAX_SIZE - idx) {
+	if (new_capa >= ARY_MAX_SIZE - idx) {
 	    new_capa = (ARY_MAX_SIZE - idx) / 2;
 	}
 	new_capa += idx;
@@ -979,10 +979,10 @@ rb_ary_splice(ary, beg, len, rpl)
     rb_ary_modify(ary);
 
     if (beg >= RARRAY(ary)->len) {
-	len = beg + rlen;
-	if (len < 0 || len > ARY_MAX_SIZE) {
+	if (beg > ARY_MAX_SIZE - rlen) {
 	    rb_raise(rb_eIndexError, "index %ld too big", beg);
 	}
+	len = beg + rlen;
 	if (len >= RARRAY(ary)->aux.capa) {
 	    REALLOC_N(RARRAY(ary)->ptr, VALUE, len);
 	    RARRAY(ary)->aux.capa = len;