Fixed heap buffer overflow in `mrb_ary_unshift_m`; fix #3760

00666139 · Yukihiro "Matz" Matsumoto · 36dbfd9b · 00666139
Commit 00666139 authored Aug 05, 2017 by Yukihiro "Matz" Matsumoto
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 2 deletions

src/array.c src/array.c +2 -2

No files found.
--- a/src/array.c
+++ b/src/array.c
@@ -584,8 +584,8 @@ mrb_ary_unshift_m(mrb_state *mrb, mrb_value self)
  }
  array_copy(ptr, vals, alen);
  ARY_SET_LEN(a, len+alen);
-  while (len--) {
-    mrb_field_write_barrier_value(mrb, (struct RBasic*)a, vals[len]);
+  while (alen--) {
+    mrb_field_write_barrier_value(mrb, (struct RBasic*)a, vals[alen]);
  }

  return self;