Skip to content
Permalink
Browse files
Check array max size
Fix #3354
  • Loading branch information
ksss committed Dec 27, 2016
1 parent 000a311 commit caba1a19dc3f9e31612d8439cfa7fbf60d05bbb0
Showing 1 changed file with 4 additions and 0 deletions.
@@ -619,6 +619,10 @@ mrb_ary_splice(mrb_state *mrb, mrb_value ary, mrb_int head, mrb_int len, mrb_val
size = head + argc;

if (tail < a->len) size += a->len - tail;

if (size < 0 || size > ARY_MAX_SIZE)
mrb_raise(mrb, E_ARGUMENT_ERROR, "array size too big");

if (size > a->aux.capa)
ary_expand_capa(mrb, a, size);

0 comments on commit caba1a1

Please sign in to comment.