Actions
Bug #15951
closedIssue with Array#rindex when rb_equal call modifies receiver
Description
Hi, this causes out of bounds RARRAY_AREF call in rb_ary_rindex
in trunk branch, and results in a segmentation fault on my system:
o = Object.new
def o.==(other)
other.replace([]) if Array === other
false
end
a = Array.new(10)
a.fill(o)
p a.rindex(a)
The fix is to check the array length after the call to rb_equal
and break out of the loop if the next iteration will result in an out of bounds read.
I'll add a PR for this.
Thanks,
Actions
Like0
Like0Like0