From 0a8a321558e94c96ed03bbab1bd2048a81f52eb1 Mon Sep 17 00:00:00 2001
From: nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Tue, 11 Aug 2015 05:57:11 +0000
Subject: [PATCH] array.c: fix buffer size

* array.c (rb_ary_repeated_permutation): fix buffer size, ALLOCV_N
  already multiplies element size.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@51532 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ChangeLog | 5 +++++
 array.c   | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 3ae6d0d755..ca4cf44752 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Tue Aug 11 14:57:09 2015  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* array.c (rb_ary_repeated_permutation): fix buffer size, ALLOCV_N
+	  already multiplies element size.
+
 Tue Aug 11 12:13:20 2015  Jeremy Evans  <merch-redmine@jeremyevans.net>
 
 	* test/openssl/test_ssl.rb: Fix LocalJumpErrors being raised
diff --git a/array.c b/array.c
index 27b6325aa2..d101d3bb6a 100644
--- a/array.c
+++ b/array.c
@@ -5179,7 +5179,7 @@ rb_ary_repeated_permutation(VALUE ary, VALUE num)
     }
     else {             /* this is the general case */
 	volatile VALUE t0;
-	long *p = ALLOCV_N(long, t0, r * sizeof(long));
+	long *p = ALLOCV_N(long, t0, r);
 	VALUE ary0 = ary_make_shared_copy(ary); /* private defensive copy of ary */
 	RBASIC_CLEAR_CLASS(ary0);