diff options
author | matz <matz@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2007-09-05 13:37:18 +0000 |
---|---|---|
committer | matz <matz@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2007-09-05 13:37:18 +0000 |
commit | 9df2b5fd0cc6170bd25bf4dc4bf1775c105c29a2 (patch) | |
tree | 075e16164dd9443658c7fc94d87188e7b16ad696 /array.c | |
parent | c349959778f17cb322b065a02da4183825f8e69e (diff) |
* array.c (rb_ary_subseq): need integer overflow check.
[ruby-dev:31736]
* array.c (rb_ary_splice): ditto. [ruby-dev:31737]
* array.c (rb_ary_fill): ditto. [ruby-dev:31738]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@13346 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'array.c')
-rw-r--r-- | array.c | 11 |
1 files changed, 6 insertions, 5 deletions
@@ -683,10 +683,8 @@ rb_ary_subseq(VALUE ary, long beg, long len) if (beg > RARRAY_LEN(ary)) return Qnil; if (beg < 0 || len < 0) return Qnil; - if (beg + len > RARRAY_LEN(ary)) { + if (RARRAY_LEN(ary) < len || RARRAY_LEN(ary) < beg + len) { len = RARRAY_LEN(ary) - beg; - if (len < 0) - len = 0; } klass = rb_obj_class(ary); if (len == 0) return ary_new(klass, 0); @@ -994,7 +992,7 @@ rb_ary_splice(VALUE ary, long beg, long len, VALUE rpl) rb_raise(rb_eIndexError, "index %ld out of array", beg); } } - if (beg + len > RARRAY_LEN(ary)) { + if (RARRAY_LEN(ary) < len || RARRAY_LEN(ary) < beg + len) { len = RARRAY_LEN(ary) - beg; } @@ -2140,7 +2138,10 @@ rb_ary_fill(int argc, VALUE *argv, VALUE ary) rb_ary_modify(ary); ary_iter_check(ary); end = beg + len; - if (end > RARRAY_LEN(ary)) { + if (end < 0) { + rb_raise(rb_eArgError, "argument too big"); + } + if (RARRAY_LEN(ary) < end) { if (end >= ARY_CAPA(ary)) { RESIZE_CAPA(ary, end); } |