From 1f554ff8540d61e30d0e649bf80c0ecd27b40ad6 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Wed, 16 Nov 2016 02:10:44 +0900
Subject: Fixed rindex calling into mrb_equal bug

Fixed by Alex Snaps and reported by Mathieu Leduc-Hamel,
both from shopify.com.  Thank you!
---
 src/array.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src/array.c')

diff --git a/src/array.c b/src/array.c
index e8882b7a3..5a319d809 100644
--- a/src/array.c
+++ b/src/array.c
@@ -868,13 +868,16 @@ static mrb_value
 mrb_ary_rindex_m(mrb_state *mrb, mrb_value self)
 {
   mrb_value obj;
-  mrb_int i;
+  mrb_int i, len;
 
   mrb_get_args(mrb, "o", &obj);
   for (i = RARRAY_LEN(self) - 1; i >= 0; i--) {
     if (mrb_equal(mrb, RARRAY_PTR(self)[i], obj)) {
       return mrb_fixnum_value(i);
     }
+    if (i > (len = RARRAY_LEN(self))) {
+      i = len;
+    }
   }
   return mrb_nil_value();
 }
-- 
cgit v1.2.3