1 files changed, 1 insertions, 0 deletions
diff --git a/array.c b/array.c
index 16ac706941..8573746f46 100644
--- a/array.c
+++ b/array.c
@@ -2127,6 +2127,7 @@ rb_ary_fill(int argc, VALUE *argv, VALUE ary)
 	    if (beg < 0) beg = 0;
 	}
 	len = NIL_P(arg2) ? RARRAY_LEN(ary) - beg : NUM2LONG(arg2);
+	if (len < 0) rb_raise(rb_eIndexError, "negative length (%ld)", len);
 	break;
     }
     rb_ary_modify(ary);