diff options
| author | ksss <[email protected]> | 2016-12-27 15:48:53 +0900 |
|---|---|---|
| committer | ksss <[email protected]> | 2016-12-27 15:48:53 +0900 |
| commit | caba1a19dc3f9e31612d8439cfa7fbf60d05bbb0 (patch) | |
| tree | 44f6ee53b17773eb972bfdc36e4d0c5e91db8436 /src/array.c | |
| parent | 000a3119ca152db12c6e36501b65e27a8be9a53e (diff) | |
| download | mruby-caba1a19dc3f9e31612d8439cfa7fbf60d05bbb0.tar.gz mruby-caba1a19dc3f9e31612d8439cfa7fbf60d05bbb0.zip | |
Check array max size
Fix #3354
Diffstat (limited to 'src/array.c')
| -rw-r--r-- | src/array.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/array.c b/src/array.c index 056d72920..2ce4e5dc6 100644 --- a/src/array.c +++ b/src/array.c @@ -619,6 +619,10 @@ mrb_ary_splice(mrb_state *mrb, mrb_value ary, mrb_int head, mrb_int len, mrb_val size = head + argc; if (tail < a->len) size += a->len - tail; + + if (size < 0 || size > ARY_MAX_SIZE) + mrb_raise(mrb, E_ARGUMENT_ERROR, "array size too big"); + if (size > a->aux.capa) ary_expand_capa(mrb, a, size); |