diff --git a/ChangeLog b/ChangeLog
index 37bae634f6..0722190fae 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Sun Jun 29 19:19:42 2008  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* array.c (rb_ary_fill): check for negative length.
+
 Sun Jun 29 18:09:00 2008  Kouhei Sutou  <kou@cozmixng.org>
 
 	* NEWS: add an entry for rss.
diff --git a/array.c b/array.c
index f4ed6e67d8..ddd198d17f 100644
--- a/array.c
+++ b/array.c
@@ -2413,6 +2413,7 @@ rb_ary_fill(argc, argv, ary)
 	    if (beg < 0) beg = 0;
 	}
 	len = NIL_P(arg2) ? RARRAY(ary)->len - beg : NUM2LONG(arg2);
+	if (len < 0) rb_raise(rb_eIndexError, "negative length (%ld)", len);
 	break;
     }
     rb_ary_modify(ary);