From b5da45d6d7435d42591bc5c65c9c015984f2e4b2 Mon Sep 17 00:00:00 2001 From: rhe Date: Tue, 20 Dec 2016 06:53:44 +0000 Subject: [PATCH] array.c: do not resize to less than 0 Shrinking the Array from the block invoked by Array#select! or Array#reject! causes the Array to be a negative number size. Ensure that the resulting Array won't be smaller than 0. [ruby-core:78739] [Bug #13053] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57121 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- array.c | 8 +++++--- test/ruby/test_array.rb | 5 +++++ 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/array.c b/array.c index b7ef04f397..580d1838a1 100644 --- a/array.c +++ b/array.c @@ -2886,13 +2886,15 @@ select_bang_ensure(VALUE a) long len = RARRAY_LEN(ary); long i1 = arg->len[0], i2 = arg->len[1]; - if (i2 < i1) { + if (i2 < len && i2 < i1) { + long tail = 0; if (i1 < len) { + tail = len - i1; RARRAY_PTR_USE(ary, ptr, { - MEMMOVE(ptr + i2, ptr + i1, VALUE, len - i1); + MEMMOVE(ptr + i2, ptr + i1, VALUE, tail); }); } - ARY_SET_LEN(ary, len - i1 + i2); + ARY_SET_LEN(ary, i2 + tail); } return ary; } diff --git a/test/ruby/test_array.rb b/test/ruby/test_array.rb index 563a37ee2e..08100142f8 100644 --- a/test/ruby/test_array.rb +++ b/test/ruby/test_array.rb @@ -2163,6 +2163,11 @@ class TestArray < Test::Unit::TestCase } assert_equal(9, r) assert_equal(@cls[7, 8, 9, 10], a, bug10722) + + bug13053 = '[ruby-core:78739] [Bug #13053] Array#select! can resize to negative size' + a = @cls[ 1, 2, 3, 4, 5 ] + a.select! {|i| a.clear if i == 5; false } + assert_equal(0, a.size, bug13053) end # also select!