diff options
| author | Mike Dalessio <mike.dalessio@gmail.com> | 2021-08-28 10:29:17 -0400 |
|---|---|---|
| committer | Nobuyoshi Nakada <nobu@ruby-lang.org> | 2021-08-29 09:41:22 +0900 |
| commit | d43279edacd09edf3a43e02d62f5be475e7c3bcb (patch) | |
| tree | f91f3e1e6ed828604ef84fb6ff62b12b75eaca6c /spec/ruby | |
| parent | 7e36b91526fdcd83f8a54f4f1f574c89ed0bedee (diff) | |
Fix length calculation for Array#slice!
Commit 4f24255 introduced a bug which allows a length to be passed to
rb_ary_new4 which is too large, resulting in invalid memory access.
For example:
(1..1000).to_a.slice!(-2, 1000)
Notes
Notes:
Merged: https://github.com/ruby/ruby/pull/4787
Diffstat (limited to 'spec/ruby')
0 files changed, 0 insertions, 0 deletions