Fixed rindex calling into mrb_equal bug

Fixed by Alex Snaps and reported by Mathieu Leduc-Hamel,
both from shopify.com.  Thank you!

2 files changed, 16 insertions, 1 deletions

diff --git a/src/array.c b/src/array.c
index e8882b7a3..5a319d809 100644
--- a/src/array.c
+++ b/src/array.c
@@ -868,13 +868,16 @@ static mrb_value
 mrb_ary_rindex_m(mrb_state *mrb, mrb_value self)
 {
   mrb_value obj;
-  mrb_int i;
+  mrb_int i, len;
 
   mrb_get_args(mrb, "o", &obj);
   for (i = RARRAY_LEN(self) - 1; i >= 0; i--) {
     if (mrb_equal(mrb, RARRAY_PTR(self)[i], obj)) {
       return mrb_fixnum_value(i);
     }
+    if (i > (len = RARRAY_LEN(self))) {
+      i = len;
+    }
   }
   return mrb_nil_value();
 }
diff --git a/test/t/array.rb b/test/t/array.rb
index 538ea0c3f..d887c117b 100644
--- a/test/t/array.rb
+++ b/test/t/array.rb
@@ -347,3 +347,15 @@ assert("Array (Longish inline array)") do
   ary.each {|p| h[p.class] += 1}
   assert_equal({Array=>200}, h)
 end
+
+assert("Array#rindex") do
+  class Sneaky
+    def ==(*)
+      $a.clear
+      $a.replace([1])
+      false
+    end
+  end
+  $a = [2, 3, 4, 5, 6, 7, 8, 9, 10, Sneaky.new]
+  assert_equal 0, $a.rindex(1)
+end