1 files changed, 12 insertions, 4 deletions
diff --git a/node.c b/node.c
index 84e7bddf34..022f5e0925 100644
--- a/node.c
+++ b/node.c
@@ -1079,10 +1079,18 @@ rb_gc_mark_node(NODE *obj)
 void *
 rb_alloc_tmp_buffer(volatile VALUE *store, long len)
 {
-    NODE *s = rb_node_newnode(NODE_ALLOCA, 0, 0, 0);
-    void *ptr = xmalloc(len);
-    s->u1.node = ptr;
-    s->u3.cnt = len / sizeof(VALUE);
+    NODE *s;
+    long cnt;
+    void *ptr;
+
+    if (len < 0 || (cnt = (long)roomof(len, sizeof(VALUE))) < 0) {
+	rb_raise(rb_eArgError, "negative buffer size (or size too big)");
+    }
+
+    s = rb_node_newnode(NODE_ALLOCA, 0, 0, 0);
+    ptr = xmalloc(cnt * sizeof(VALUE));
+    s->u1.value = (VALUE)ptr;
+    s->u3.cnt = cnt;
     *store = (VALUE)s;
     return ptr;
 }