5877968.diff   [plain text]

--- array.old.c	2008-04-22 11:19:35.000000000 -0700
+++ array.c	2008-04-23 00:45:01.000000000 -0700
@@ -976,6 +976,9 @@
 
     if (beg >= RARRAY(ary)->len) {
 	len = beg + rlen;
+	if (len < 0 || len > LONG_MAX / sizeof(VALUE)) {
+		rb_raise(rb_eIndexError, "index %ld too big", beg);
+	}
 	if (len >= RARRAY(ary)->aux.capa) {
 	    REALLOC_N(RARRAY(ary)->ptr, VALUE, len);
 	    RARRAY(ary)->aux.capa = len;