Bug #20427 ยป rb_ary_sort_bang_heap_overflow.patch
| array.c | ||
|---|---|---|
|
rb_ary_unshare(ary);
|
||
|
FL_SET_EMBED(ary);
|
||
|
}
|
||
|
if (ARY_EMBED_LEN(tmp) > ARY_CAPA(ary)) {
|
||
|
ary_resize_capa(ary, ARY_EMBED_LEN(tmp));
|
||
|
}
|
||
|
ary_memcpy(ary, 0, ARY_EMBED_LEN(tmp), ARY_EMBED_PTR(tmp));
|
||
|
ARY_SET_LEN(ary, ARY_EMBED_LEN(tmp));
|
||
|
}
|
||
| test/ruby/test_array.rb | ||
|---|---|---|
|
assert_equal(10000, eval(lit).size)
|
||
|
end
|
||
|
def test_array_safely_modified_by_sort_block
|
||
|
var_0 = (1..70).to_a
|
||
|
var_0.sort! do |var_0_block_129, var_1_block_129|
|
||
|
var_0.pop
|
||
|
var_1_block_129 <=> var_0_block_129
|
||
|
end.shift(3)
|
||
|
assert_equal((1..67).to_a.reverse, var_0)
|
||
|
end
|
||
|
private
|
||
|
def need_continuation
|
||
|
unless respond_to?(:callcc, true)
|
||