From 3d2a71470341f76fc3bf5c3fc930e9d1b5867b0e Mon Sep 17 00:00:00 2001 From: rhe Date: Tue, 20 Dec 2016 06:53:44 +0000 Subject: array.c: do not resize to less than 0 Shrinking the Array from the block invoked by Array#select! or Array#reject! causes the Array to be a negative number size. Ensure that the resulting Array won't be smaller than 0. [ruby-core:78739] [Bug #13053] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57121 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- array.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'array.c') diff --git a/array.c b/array.c index b7ef04f397..580d1838a1 100644 --- a/array.c +++ b/array.c @@ -2886,13 +2886,15 @@ select_bang_ensure(VALUE a) long len = RARRAY_LEN(ary); long i1 = arg->len[0], i2 = arg->len[1]; - if (i2 < i1) { + if (i2 < len && i2 < i1) { + long tail = 0; if (i1 < len) { + tail = len - i1; RARRAY_PTR_USE(ary, ptr, { - MEMMOVE(ptr + i2, ptr + i1, VALUE, len - i1); + MEMMOVE(ptr + i2, ptr + i1, VALUE, tail); }); } - ARY_SET_LEN(ary, len - i1 + i2); + ARY_SET_LEN(ary, i2 + tail); } return ary; } -- cgit v1.2.3