5876803.diff   [plain text]

--- array.old.c	2008-04-22 11:19:35.000000000 -0700
+++ array.c	2008-04-22 11:23:38.000000000 -0700
@@ -367,8 +367,8 @@
 	    new_capa = ARY_DEFAULT_SIZE;
 	}
 	new_capa += idx;
-	if (new_capa * (long)sizeof(VALUE) <= new_capa) {
-	    rb_raise(rb_eArgError, "index too big");
+	if (new_capa < 0 || new_capa > LONG_MAX / sizeof(VALUE)) {
+		rb_raise(rb_eArgError, "index too big");
 	}
 	REALLOC_N(RARRAY(ary)->ptr, VALUE, new_capa);
 	RARRAY(ary)->aux.capa = new_capa;