array.c: fix array size

* array.c (rb_ary_permutation): `p` is the array of size `r`, as
  commented at permute0().  since `n >= r` here, buffer overflow
  never happened, just reduce unnecessary allocation though.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@46416 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 1 insertions, 1 deletions

diff --git a/array.c b/array.c
index 3f5605526e..e8c7fc9627 100644
--- a/array.c
+++ b/array.c
@@ -4858,7 +4858,7 @@ rb_ary_permutation(int argc, VALUE *argv, VALUE ary)
 	}
     }
     else {             /* this is the general case */
-	volatile VALUE t0 = tmpbuf(n,sizeof(long));
+	volatile VALUE t0 = tmpbuf(r,sizeof(long));
 	long *p = (long*)RSTRING_PTR(t0);
 	volatile VALUE t1 = tmpbuf(n,sizeof(char));
 	char *used = (char*)RSTRING_PTR(t1);