Merge pull request #3366 from ksss/splice

Check array max size

Merge pull request #3366 from ksss/splice
Check array max size
6af8cc36 · Yukihiro "Matz" Matsumoto · GitHub · 30d5424a · caba1a19 · 6af8cc36
Commit 6af8cc36 authored Dec 28, 2016 by Yukihiro "Matz" Matsumoto Committed by GitHub Dec 28, 2016
Show whitespace changes
Inline Side-by-side

Showing with 4 additions and 0 deletions

src/array.c src/array.c +4 -0

No files found.
--- a/src/array.c
+++ b/src/array.c
@@ -619,6 +619,10 @@ mrb_ary_splice(mrb_state *mrb, mrb_value ary, mrb_int head, mrb_int len, mrb_val
  size = head + argc;

  if (tail < a->len) size += a->len - tail;
+
+  if (size < 0 || size > ARY_MAX_SIZE)
+    mrb_raise(mrb, E_ARGUMENT_ERROR, "array size too big");
+
  if (size > a->aux.capa)
    ary_expand_capa(mrb, a, size);