diff --git a/ChangeLog b/ChangeLog
index d20cd2b0fc..1368c12097 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+Tue Mar 25 19:09:04 2008  Yusuke Endoh  <mame@tsg.ne.jp>
+
+	* array.c (ary_new): fix size check.  [ruby-dev:34123]
+
+	* array.c (rb_ary_take, rb_ary_drop): check negative size and use
+	  NUM2LONG instead of FIX2LONG.  [ruby-dev:34123]
+
+	* enum.c (enum_take, enum_drop): check negative size.
+
+	* test/ruby/test_array.rb: add tests for above.
+
 Tue Mar 25 16:32:56 2008  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* ruby.c (proc_options): checks if the word is empty.
diff --git a/array.c b/array.c
index 332dc3b993..da19f1c6a6 100644
--- a/array.c
+++ b/array.c
@@ -114,7 +114,7 @@ ary_new(VALUE klass, long len)
     if (len < 0) {
 	rb_raise(rb_eArgError, "negative array size (or size too big)");
     }
-    if (len > 0 && len * sizeof(VALUE) <= len) {
+    if (len > 0 && len * (long)sizeof(VALUE) <= len) {
 	rb_raise(rb_eArgError, "array size too big");
     }
     ary = ary_alloc(klass);
@@ -3242,7 +3242,11 @@ rb_ary_product(int argc, VALUE *argv, VALUE ary)
 static VALUE
 rb_ary_take(VALUE obj, VALUE n)
 {
-    return rb_ary_subseq(obj, 0, FIX2LONG(n));
+    long len = NUM2LONG(n);
+    if (len < 0) {
+	rb_raise(rb_eArgError, "attempt to take negative size");
+    }
+    return rb_ary_subseq(obj, 0, len);
 }
 
 /*
@@ -3286,8 +3290,12 @@ static VALUE
 rb_ary_drop(VALUE ary, VALUE n)
 {
     VALUE result;
+    long pos = NUM2LONG(n);
+    if (pos < 0) {
+	rb_raise(rb_eArgError, "attempt to drop negative size");
+    }
 
-    result = rb_ary_subseq(ary, FIX2LONG(n), RARRAY_LEN(ary));
+    result = rb_ary_subseq(ary, pos, RARRAY_LEN(ary));
     if (result == Qnil) result = rb_ary_new();
     return result;
 }
diff --git a/enum.c b/enum.c
index 0715772a39..b09e82623f 100644
--- a/enum.c
+++ b/enum.c
@@ -1499,9 +1499,14 @@ static VALUE
 enum_take(VALUE obj, VALUE n)
 {
     VALUE args[2];
+    long len = NUM2LONG(n);
 
-    args[1] = NUM2LONG(n);
-    args[0] = rb_ary_new2(args[1]);
+    if (len < 0) {
+	rb_raise(rb_eArgError, "attempt to take negative size");
+    }
+
+    args[1] = len;
+    args[0] = rb_ary_new();
     rb_block_call(obj, id_each, 0, 0, take_i, (VALUE)args);
     return args[0];
 }
@@ -1566,9 +1571,14 @@ static VALUE
 enum_drop(VALUE obj, VALUE n)
 {
     VALUE args[2];
+    long len = NUM2LONG(n);
 
-    args[1] = NUM2ULONG(n);
-    args[0] = rb_ary_new2(args[1]);
+    if (len < 0) {
+	rb_raise(rb_eArgError, "attempt to drop negative size");
+    }
+
+    args[1] = len;
+    args[0] = rb_ary_new();
     rb_block_call(obj, id_each, 0, 0, drop_i, (VALUE)args);
     return args[0];
 }
diff --git a/test/ruby/test_array.rb b/test/ruby/test_array.rb
index ea2cef85cd..e9dab8e192 100644
--- a/test/ruby/test_array.rb
+++ b/test/ruby/test_array.rb
@@ -1232,6 +1232,8 @@ class TestArray < Test::Unit::TestCase
 
   def test_take
     assert_equal([1,2,3], [1,2,3,4,5,0].take(3))
+    assert_raise(ArgumentError, '[ruby-dev:34123]') { [1,2].take(-1) }
+    assert_equal([1,2], [1,2].take(1000000000), '[ruby-dev:34123]')
   end
 
   def test_take_while
@@ -1240,6 +1242,8 @@ class TestArray < Test::Unit::TestCase
 
   def test_drop
     assert_equal([4,5,0], [1,2,3,4,5,0].drop(3))
+    assert_raise(ArgumentError, '[ruby-dev:34123]') { [1,2].drop(-1) }
+    assert_equal([], [1,2].drop(1000000000), '[ruby-dev:34123]')
   end
 
   def test_drop_while