diff --git a/ChangeLog b/ChangeLog
index 2496c6de0e..b43b00a1b1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Tue Nov 25 16:26:12 2008  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* array.c (rb_ary_times): taint (and untrust) status should be
+	  inherited by "ary * 0".  [ruby-dev:37024]
+
 Tue Nov 25 15:54:07 2008  Yukihiro Matsumoto  <matz@ruby-lang.org>
 
 	* strftime.c (rb_strftime): should not swallow incomplete
diff --git a/array.c b/array.c
index 5553b8ff2f..578f7fae90 100644
--- a/array.c
+++ b/array.c
@@ -2551,7 +2551,10 @@ rb_ary_times(VALUE ary, VALUE times)
     }
 
     len = NUM2LONG(times);
-    if (len == 0) return ary_new(rb_obj_class(ary), 0);
+    if (len == 0) {
+	ary2 = ary_new(rb_obj_class(ary), 0);
+	goto out;
+    }
     if (len < 0) {
 	rb_raise(rb_eArgError, "negative argument");
     }
@@ -2566,6 +2569,7 @@ rb_ary_times(VALUE ary, VALUE times)
     for (i=0; i<len; i+=RARRAY_LEN(ary)) {
 	MEMCPY(RARRAY_PTR(ary2)+i, RARRAY_PTR(ary), VALUE, RARRAY_LEN(ary));
     }
+  out:
     OBJ_INFECT(ary2, ary);
 
     return ary2;