merge revision(s) 57119: [Backport #13052]

	array.c: check array length every time after yielding

	Since the Array may be modified during rb_yield(), the length before
	invoking the block can't be trusted. Fix possible out-of-bounds read in
	Array#combination and Array#repeated_combination.

	It may better to make a defensive copy of the Array, but for now let's
	follow what Array#permutation does.  [ruby-core:78738] [Bug #13052]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_2@57220 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 2 insertions, 2 deletions

diff --git a/array.c b/array.c
index 28e43c68c0..1ae14edf3a 100644
--- a/array.c
+++ b/array.c
@@ -4985,7 +4985,7 @@ rb_ary_combination(VALUE ary, VALUE num)
 	rb_yield(rb_ary_new2(0));
     }
     else if (n == 1) {
-	for (i = 0; i < len; i++) {
+	for (i = 0; i < RARRAY_LEN(ary); i++) {
 	    rb_yield(rb_ary_new3(1, RARRAY_AREF(ary, i)));
 	}
     }
@@ -5184,7 +5184,7 @@ rb_ary_repeated_combination(VALUE ary, VALUE num)
 	rb_yield(rb_ary_new2(0));
     }
     else if (n == 1) {
-	for (i = 0; i < len; i++) {
+	for (i = 0; i < RARRAY_LEN(ary); i++) {
 	    rb_yield(rb_ary_new3(1, RARRAY_AREF(ary, i)));
 	}
     }