merge revision(s) r46416: [Backport ruby#9942]

	* array.c (rb_ary_permutation): `p` is the array of size `r`, as
	  commented at permute0().  since `n >= r` here, buffer overflow
	  never happened, just reduce unnecessary allocation though.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_1@46807 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

Author: nagachika

ChangeLog

@@ -1,3 +1,9 @@
+Sun Jul 13 23:02:36 2014  Nobuyoshi Nakada  <[email protected]>
+
+	* array.c (rb_ary_permutation): `p` is the array of size `r`, as
+	  commented at permute0().  since `n >= r` here, buffer overflow
+	  never happened, just reduce unnecessary allocation though.
+
 Sun Jul 13 22:52:43 2014  Nobuyoshi Nakada  <[email protected]>
 
 	* pack.c (encodes): fix buffer overrun by tail_lf.  Thanks to

array.c

@@ -4818,7 +4818,7 @@ rb_ary_permutation(int argc, VALUE *argv, VALUE ary)
 	}
     }
     else {             /* this is the general case */
-	volatile VALUE t0 = tmpbuf(n,sizeof(long));
+	volatile VALUE t0 = tmpbuf(r,sizeof(long));
 	long *p = (long*)RSTRING_PTR(t0);
 	volatile VALUE t1 = tmpbuf(n,sizeof(char));
 	char *used = (char*)RSTRING_PTR(t1);

version.h

@@ -1,6 +1,6 @@
 #define RUBY_VERSION "2.1.2"
 #define RUBY_RELEASE_DATE "2014-07-13"
-#define RUBY_PATCHLEVEL 171
+#define RUBY_PATCHLEVEL 172
 
 #define RUBY_RELEASE_YEAR 2014
 #define RUBY_RELEASE_MONTH 7