diff options
-rw-r--r-- | ChangeLog | 5 | ||||
-rw-r--r-- | array.c | 4 |
2 files changed, 7 insertions, 2 deletions
@@ -1,3 +1,8 @@ +Wed Jun 25 15:28:50 2008 Nobuyoshi Nakada <nobu@ruby-lang.org> + + * array.c (rb_ary_fill): not depend on unspecified behavior at integer + overflow. reported by Vincenzo Iozzo <snagg AT openssl.it>. + Wed Jun 25 13:42:44 2008 NARUSE, Yui <naruse@ruby-lang.org> * lib/erb.rb (ERB::Compiler:Buffer#new): push magic comment first. @@ -2145,10 +2145,10 @@ rb_ary_fill(int argc, VALUE *argv, VALUE ary) break; } rb_ary_modify(ary); - end = beg + len; - if (end < 0) { + if (len > ARY_MAX_SIZE - beg) { rb_raise(rb_eArgError, "argument too big"); } + end = beg + len; if (RARRAY_LEN(ary) < end) { if (end >= ARY_CAPA(ary)) { RESIZE_CAPA(ary, end); |