diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2017-06-20 20:19:37 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2017-06-20 20:19:37 +0900 |
| commit | bf1cb87b34af41e8877b8c24e5fc37fc07a0394e (patch) | |
| tree | b1cd88016fd34240087096332c1e783065e72231 /src/array.c | |
| parent | 39779b339e12c81d2fd9dcc5d0a9c40bed965430 (diff) | |
| download | mruby-bf1cb87b34af41e8877b8c24e5fc37fc07a0394e.tar.gz mruby-bf1cb87b34af41e8877b8c24e5fc37fc07a0394e.zip | |
Array size can be cause integer overflow; fix #3710
Diffstat (limited to 'src/array.c')
| -rw-r--r-- | src/array.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/array.c b/src/array.c index 86fb50e5c..8b6b9fa1e 100644 --- a/src/array.c +++ b/src/array.c @@ -169,7 +169,7 @@ ary_expand_capa(mrb_state *mrb, struct RArray *a, mrb_int len) { mrb_int capa = a->aux.capa; - if (len > ARY_MAX_SIZE) { + if (len > ARY_MAX_SIZE || len < 0) { size_error: mrb_raise(mrb, E_ARGUMENT_ERROR, "array size too big"); } |