Fixed rindex calling into mrb_equal bug

Fixed by Alex Snaps and reported by Mathieu Leduc-Hamel,
both from shopify.com.  Thank you!

1 files changed, 4 insertions, 1 deletions

diff --git a/src/array.c b/src/array.c
index e8882b7a3..5a319d809 100644
--- a/src/array.c
+++ b/src/array.c
@@ -868,13 +868,16 @@ static mrb_value
 mrb_ary_rindex_m(mrb_state *mrb, mrb_value self)
 {
   mrb_value obj;
-  mrb_int i;
+  mrb_int i, len;
 
   mrb_get_args(mrb, "o", &obj);
   for (i = RARRAY_LEN(self) - 1; i >= 0; i--) {
     if (mrb_equal(mrb, RARRAY_PTR(self)[i], obj)) {
       return mrb_fixnum_value(i);
     }
+    if (i > (len = RARRAY_LEN(self))) {
+      i = len;
+    }
   }
   return mrb_nil_value();
 }