Fix memory corruption in Enumerable#reverse_each [ruby-dev:50867] [Bug #16354]

1 files changed, 9 insertions, 3 deletions

diff --git a/enum.c b/enum.c
index 0653280f8f..a41144993e 100644
--- a/enum.c
+++ b/enum.c
@@ -2419,14 +2419,20 @@ static VALUE
 enum_reverse_each(int argc, VALUE *argv, VALUE obj)
 {
     VALUE ary;
-    long i;
+    long len;
 
     RETURN_SIZED_ENUMERATOR(obj, argc, argv, enum_size);
 
     ary = enum_to_a(argc, argv, obj);
 
-    for (i = RARRAY_LEN(ary); --i >= 0; ) {
-	rb_yield(RARRAY_AREF(ary, i));
+    len = RARRAY_LEN(ary);
+    while (len--) {
+        long nlen;
+        rb_yield(RARRAY_AREF(ary, len));
+        nlen = RARRAY_LEN(ary);
+        if (nlen < len) {
+            len = nlen;
+        }
     }
 
     return obj;