fix segmentation fault in Array#last

2 files changed, 12 insertions, 1 deletions

diff --git a/src/array.c b/src/array.c
index ed1c3f475..0f52c38ef 100644
--- a/src/array.c
+++ b/src/array.c
@@ -789,6 +789,9 @@ mrb_ary_last(mrb_state *mrb, mrb_value self)
 
   /* len == 1 */
   size = mrb_fixnum(*vals);
+  if (size < 0) {
+    mrb_raise(mrb, E_ARGUMENT_ERROR, "negative array size");
+  }
   if (size > a->len) size = a->len;
   if ((a->flags & MRB_ARY_SHARED) || size > ARY_DEFAULT_LEN) {
     return ary_subseq(mrb, a, a->len - size, size);
diff --git a/test/t/array.rb b/test/t/array.rb
index a1ef830a2..4ed12a58f 100644
--- a/test/t/array.rb
+++ b/test/t/array.rb
@@ -152,7 +152,15 @@ end
 assert('Array#last', '15.2.12.5.18') do
   a = [1,2,3]
 
-  a.last == 3 and [].last == nil
+  e2 = nil
+  begin
+    # this will cause an exception due to the wrong argument
+    [1,2,3].last(-1)
+  rescue => e1
+    e2 = e1
+  end
+
+  a.last == 3 and [].last == nil and e2.class == ArgumentError
 end
 
 assert('Array#length', '15.2.12.5.19') do