* array.c (sort_2): *a - *b may overflow.

* array.c (ary_new): len*sizeof(VALUE) may be a positive value.

* array.c (rb_ary_initialize): ditto.

* object.c (rb_class_allocate_instance): move singleton class
  check from rb_obj_alloc().

* re.c (rb_reg_initialize): should not modify frozen Regexp.

* ext/tcltklib/tcltklib.c (ip_init): allocation framework.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@2720 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 3 insertions, 0 deletions

diff --git a/re.c b/re.c
index 5663f02919..94cefa4bbc 100644
--- a/re.c
+++ b/re.c
@@ -959,6 +959,9 @@ rb_reg_initialize(obj, s, len, options)
 {
     struct RRegexp *re = RREGEXP(obj);
 
+    if (OBJ_FROZEN(obj)) {
+	rb_error_frozen("Regexp");
+    }
     if (re->ptr) re_free_pattern(re->ptr);
     if (re->str) free(re->str);
     re->ptr = 0;