Array size can be cause integer overflow; fix #3710

bf1cb87b · Yukihiro "Matz" Matsumoto · 39779b33 · bf1cb87b
Commit bf1cb87b authored Jun 20, 2017 by Yukihiro "Matz" Matsumoto
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

src/array.c src/array.c +1 -1

No files found.
--- a/src/array.c
+++ b/src/array.c
@@ -169,7 +169,7 @@ ary_expand_capa(mrb_state *mrb, struct RArray *a, mrb_int len)
 {
  mrb_int capa = a->aux.capa;
-  if (len > ARY_MAX_SIZE) {
+  if (len > ARY_MAX_SIZE || len < 0) {
  size_error:
    mrb_raise(mrb, E_ARGUMENT_ERROR, "array size too big");
  }