Bug #20427 ยป rb_ary_sort_bang_heap_overflow.patch
array.c | ||
---|---|---|
rb_ary_unshare(ary);
|
||
FL_SET_EMBED(ary);
|
||
}
|
||
if (ARY_EMBED_LEN(tmp) > ARY_CAPA(ary)) {
|
||
ary_resize_capa(ary, ARY_EMBED_LEN(tmp));
|
||
}
|
||
ary_memcpy(ary, 0, ARY_EMBED_LEN(tmp), ARY_EMBED_PTR(tmp));
|
||
ARY_SET_LEN(ary, ARY_EMBED_LEN(tmp));
|
||
}
|
test/ruby/test_array.rb | ||
---|---|---|
assert_equal(10000, eval(lit).size)
|
||
end
|
||
def test_array_safely_modified_by_sort_block
|
||
var_0 = (1..70).to_a
|
||
var_0.sort! do |var_0_block_129, var_1_block_129|
|
||
var_0.pop
|
||
var_1_block_129 <=> var_0_block_129
|
||
end.shift(3)
|
||
assert_equal((1..67).to_a.reverse, var_0)
|
||
end
|
||
private
|
||
def need_continuation
|
||
unless respond_to?(:callcc, true)
|