diff --git a/mrbgems/mruby-array-ext/src/array.c b/mrbgems/mruby-array-ext/src/array.c index 41ed3612d..520327be1 100644 --- a/mrbgems/mruby-array-ext/src/array.c +++ b/mrbgems/mruby-array-ext/src/array.c @@ -1309,6 +1309,11 @@ ary_combination_init(mrb_state *mrb, mrb_value self) mrb_bool permutation; mrb_get_args(mrb, "ib", &n, &permutation); +#if MRB_INT_MAX > SIZE_MAX + if (n > SIZE_MAX) { + mrb_raise(mrb, E_ARGUMENT_ERROR, "number too large"); + } +#endif struct RData *d; struct mrb_combination_state *state; @@ -1321,10 +1326,7 @@ ary_combination_init(mrb_state *mrb, mrb_value self) state->finished = (n <= 0 && n != 0); if (n > 0) { - state->indices = (mrb_int*)mrb_malloc(mrb, sizeof(mrb_int) * n); - for (mrb_int i = 0; i < n; i++) { - state->indices[i] = 0; - } + state->indices = (mrb_int*)mrb_calloc(mrb, n, sizeof(mrb_int)); } return mrb_obj_value(d); diff --git a/src/gc.c b/src/gc.c index 825d54600..ef91432af 100644 --- a/src/gc.c +++ b/src/gc.c @@ -243,15 +243,17 @@ mrb_calloc(mrb_state *mrb, size_t nelem, size_t len) { void *p; - if (nelem > 0 && len > 0 && - nelem <= SIZE_MAX / len) { + if (nelem == 0 || len == 0) { + p = NULL; + } + else if (nelem <= SIZE_MAX / len) { size_t size = nelem * len; p = mrb_malloc(mrb, size); memset(p, 0, size); } else { - p = NULL; + mrb_raise(mrb, E_ARGUMENT_ERROR, "memory allocation overflow"); } return p;