Array size can be cause integer overflow; fix #3710

This commit is contained in:
Yukihiro "Matz" Matsumoto
2017-06-20 20:19:37 +09:00
parent 39779b339e
commit bf1cb87b34
+1 -1
View File
@@ -169,7 +169,7 @@ ary_expand_capa(mrb_state *mrb, struct RArray *a, mrb_int len)
{
mrb_int capa = a->aux.capa;
if (len > ARY_MAX_SIZE) {
if (len > ARY_MAX_SIZE || len < 0) {
size_error:
mrb_raise(mrb, E_ARGUMENT_ERROR, "array size too big");
}