From 27b35eddd6ee9f5844c636f8201f09281e32d9bb Mon Sep 17 00:00:00 2001
From: davidflanagan <davidflanagan@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Fri, 26 Oct 2007 05:52:16 +0000
Subject: [PATCH] array.c: raise IndexError for negative length in rb_ary_fill

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@13783 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ChangeLog | 3 +++
 array.c   | 1 +
 2 files changed, 4 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 198de5299b..0600a19094 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+Fri Oct 26 05:48:57 UTC 2007  David Flanagan <davidflanagan@ruby-lang.org>
+	* array.c: raise IndexError for negative length in rb_ary_fill
+	
 Wed Oct 25 07:12:03 2007  James Edward Gray II  <jeg2@ruby-lang.org>
 
 	* lib/net/telnet.rb (Net::Telnet#login): Allowing "passphrase" in
diff --git a/array.c b/array.c
index 16ac706941..8573746f46 100644
--- a/array.c
+++ b/array.c
@@ -2127,6 +2127,7 @@ rb_ary_fill(int argc, VALUE *argv, VALUE ary)
 	    if (beg < 0) beg = 0;
 	}
 	len = NIL_P(arg2) ? RARRAY_LEN(ary) - beg : NUM2LONG(arg2);
+	if (len < 0) rb_raise(rb_eIndexError, "negative length (%ld)", len);
 	break;
     }
     rb_ary_modify(ary);