2 files changed, 10 insertions, 3 deletions
diff --git a/ChangeLog b/ChangeLog
index 3bb0aa4d53..dfe05f2a92 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,8 @@ Fri May 18 23:07:33 2007  Yukihiro Matsumoto  <matz@ruby-lang.org>
 	* array.c (rb_ary_first): call rb_ary_subseq() instead of pushing
 	  values by itself.  [ruby-talk:252062]
 
+	* array.c (rb_ary_first): add negative length check.
+
 Fri May 18 17:10:31 2007  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* win32/win32.c (move_to_next_entry): loc also must move forward.
diff --git a/array.c b/array.c
index e2bbf2bb3c..91c298d71c 100644
--- a/array.c
+++ b/array.c
@@ -748,10 +748,15 @@ rb_ary_first(argc, argv, ary)
 	return RARRAY(ary)->ptr[0];
     }
     else {
-	VALUE n;
+	VALUE nv;
+	long n;
 
-	rb_scan_args(argc, argv, "01", &n);
-	return rb_ary_subseq(ary, 0, NUM2LONG(n));
+	rb_scan_args(argc, argv, "01", &nv);
+	n = NUM2LONG(nv);
+	if (n < 0) {
+	    rb_raise(rb_eArgError, "negative array size");
+	}
+	return rb_ary_subseq(ary, 0, n);
     }
 }