mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
Array size can be cause integer overflow; fix #3710
This commit is contained in:
+1
-1
@@ -169,7 +169,7 @@ ary_expand_capa(mrb_state *mrb, struct RArray *a, mrb_int len)
|
||||
{
|
||||
mrb_int capa = a->aux.capa;
|
||||
|
||||
if (len > ARY_MAX_SIZE) {
|
||||
if (len > ARY_MAX_SIZE || len < 0) {
|
||||
size_error:
|
||||
mrb_raise(mrb, E_ARGUMENT_ERROR, "array size too big");
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user