diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2016-12-28 13:00:14 +0900 |
|---|---|---|
| committer | GitHub <[email protected]> | 2016-12-28 13:00:14 +0900 |
| commit | 6af8cc36b9403300091821ebef6629054aca8fc9 (patch) | |
| tree | c6afaf346ec70d7c7012e4cb635bee2620c33aa9 | |
| parent | 30d5424adfe881b3fba208f9673908f8d722fd9a (diff) | |
| parent | caba1a19dc3f9e31612d8439cfa7fbf60d05bbb0 (diff) | |
| download | mruby-6af8cc36b9403300091821ebef6629054aca8fc9.tar.gz mruby-6af8cc36b9403300091821ebef6629054aca8fc9.zip | |
Merge pull request #3366 from ksss/splice
Check array max size
| -rw-r--r-- | src/array.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/array.c b/src/array.c index 056d72920..2ce4e5dc6 100644 --- a/src/array.c +++ b/src/array.c @@ -619,6 +619,10 @@ mrb_ary_splice(mrb_state *mrb, mrb_value ary, mrb_int head, mrb_int len, mrb_val size = head + argc; if (tail < a->len) size += a->len - tail; + + if (size < 0 || size > ARY_MAX_SIZE) + mrb_raise(mrb, E_ARGUMENT_ERROR, "array size too big"); + if (size > a->aux.capa) ary_expand_capa(mrb, a, size); |