diff options
author | nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-02-26 07:41:34 +0000 |
---|---|---|
committer | nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-02-26 07:41:34 +0000 |
commit | 3b0f5058fa3b97a88cec5be0d1ce9699862cfa62 (patch) | |
tree | 142e2d50ff92fe3bafbf91ccdcfd68d960c24a26 /array.c | |
parent | 525b2e78e5ba3d6d76bdd9b2db747abad799a705 (diff) | |
download | ruby-3b0f5058fa3b97a88cec5be0d1ce9699862cfa62.tar.gz |
* array.c (combi_len, rb_ary_product): check for overflow.
[ruby-Bugs-18355]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@15614 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'array.c')
-rw-r--r-- | array.c | 12 |
1 files changed, 10 insertions, 2 deletions
@@ -3072,7 +3072,11 @@ combi_len(long n, long k) if (k < 0) return 0; val = 1; for (i=1; i <= k; i++,n--) { + long m = val; val *= n; + if (val < m) { + rb_raise(rb_eRangeError, "too big for combination"); + } val /= i; } return val; @@ -3185,8 +3189,12 @@ rb_ary_product(int argc, VALUE *argv, VALUE ary) /* Compute the length of the result array; return [] if any is empty */ for (i = 0; i < n; i++) { - resultlen *= RARRAY_LEN(arrays[i]); - if (resultlen == 0) return rb_ary_new2(0); + long k = RARRAY_LEN(arrays[i]), l = resultlen; + if (k == 0) return rb_ary_new2(0); + resultlen *= k; + if (resultlen < k || resultlen < l || resultlen / k != l) { + rb_raise(rb_eRangeError, "too big to product"); + } } /* Otherwise, allocate and fill in an array of results */ |