Make Array#[]= raise IndexError.

If second param is negative, Array#[] raise IndexError.

2 files changed, 9 insertions, 0 deletions

diff --git a/src/array.c b/src/array.c
index febc3a7a8..7e9c0139d 100644
--- a/src/array.c
+++ b/src/array.c
@@ -561,6 +561,10 @@ mrb_ary_splice(mrb_state *mrb, mrb_value ary, mrb_int head, mrb_int len, mrb_val
   mrb_int i, argc;
 
   ary_modify(mrb, a);
+
+  /* len check */
+  if (len < 0) mrb_raisef(mrb, E_INDEX_ERROR, "negative length (%S)", mrb_fixnum_value(len));
+
   /* range check */
   if (head < 0) {
     head += a->len;
diff --git a/test/t/array.rb b/test/t/array.rb
index 48f2fe0c4..56daf0b01 100644
--- a/test/t/array.rb
+++ b/test/t/array.rb
@@ -66,6 +66,11 @@ assert('Array#[]=', '15.2.12.5.5') do
     # this will cause an exception due to the wrong arguments
     a.[]=(1,2,3,4)
   end
+  assert_raise(IndexError) do
+    # this will cause an exception due to the wrong arguments
+    a = [1,2,3,4,5]
+    a[1, -1] = 10
+  end
 
   assert_equal(4, [1,2,3].[]=(1,4))
   assert_equal(3, [1,2,3].[]=(1,2,3))