From 38deb17a19a015b5b3b4d5a74762391ba3b6f256 Mon Sep 17 00:00:00 2001
From: matz <matz@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Mon, 14 Apr 2008 03:58:35 +0000
Subject: * array.c (ary_new): new integer overflow check condition.  
 suggested by TOYOFUKU Chikanobu <nobu_toyofuku at nifty.com> in  
 [ruby-dev:34156].

* array.c (rb_ary_initialize): ditto.

git-svn-id: http://svn.ruby-lang.org/repos/ruby/trunk@15997 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 array.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'array.c')

diff --git a/array.c b/array.c
index 8ccbd97ff..edbc35d4b 100644
--- a/array.c
+++ b/array.c
@@ -114,7 +114,7 @@ ary_new(VALUE klass, long len)
     if (len < 0) {
 	rb_raise(rb_eArgError, "negative array size (or size too big)");
     }
-    if (len > 0 && len * (long)sizeof(VALUE) <= len) {
+    if (len > LONG_MAX / sizeof(VALUE)) {
 	rb_raise(rb_eArgError, "array size too big");
     }
     ary = ary_alloc(klass);
@@ -313,7 +313,7 @@ rb_ary_initialize(int argc, VALUE *argv, VALUE ary)
     if (len < 0) {
 	rb_raise(rb_eArgError, "negative array size");
     }
-    if (len > 0 && len * (long)sizeof(VALUE) <= len) {
+    if (len > LONG_MAX / sizeof(VALUE)) {
 	rb_raise(rb_eArgError, "array size too big");
     }
     rb_ary_modify(ary);
-- 
cgit