From f8404c7a97114ab40d67fe30e525d4cd5aeb6bd2 Mon Sep 17 00:00:00 2001
From: Aparajita Fishman <aparajita@aparajita.com>
Date: Fri, 5 Aug 2011 14:36:24 -0700
Subject: [PATCH] Added some missing range checking.

---
 Foundation/CPArray/_CPJavaScriptArray.j | 27 ++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/Foundation/CPArray/_CPJavaScriptArray.j b/Foundation/CPArray/_CPJavaScriptArray.j
index bc05d40e7..9913fd890 100644
--- a/Foundation/CPArray/_CPJavaScriptArray.j
+++ b/Foundation/CPArray/_CPJavaScriptArray.j
@@ -156,8 +156,7 @@ var concat = Array.prototype.concat,
 - (void)makeObjectsPerformSelector:(SEL)aSelector withObjects:(CPArray)objects
 {
     if (!aSelector)
-        [CPException raise:CPInvalidArgumentException
-                    reason:"makeObjectsPerformSelector:withObjects: 'aSelector' can't be nil"];
+        _CPRaiseInvalidArgumentException(self, _cmd, 'attempt to pass a nil selector');
 
     var index = 0,
         count = self.length;
@@ -198,7 +197,7 @@ var concat = Array.prototype.concat,
 - (CPArray)subarrayWithRange:(CPRange)aRange
 {
     if (aRange.location < 0 || CPMaxRange(aRange) > self.length)
-        [CPException raise:CPRangeException reason:"subarrayWithRange: aRange out of bounds"];
+        [CPException raise:CPRangeException reason:_cmd + " aRange out of bounds"];
 
     return slice.call(self, aRange.location, CPMaxRange(aRange));
 }
@@ -208,13 +207,19 @@ var concat = Array.prototype.concat,
     return join.call(self, aString);
 }
 
-- (void)insertObject:(id)anObject atIndex:(CPUInteger)anIndex
+- (void)insertObject:(id)anObject atIndex:(int)anIndex
 {
+    if (anIndex >= self.length || anIndex < 0)
+        _CPRaiseRangeException(self, _cmd, anIndex, self.length);
+
     splice.call(self, anIndex, 0, anObject);
 }
 
-- (void)removeObjectAtIndex:(CPUInteger)anIndex
+- (void)removeObjectAtIndex:(int)anIndex
 {
+    if (anIndex >= self.length || anIndex < 0)
+        _CPRaiseRangeException(self, _cmd, anIndex, self.length);
+
     splice.call(self, anIndex, 1);
 }
 
@@ -235,16 +240,28 @@ var concat = Array.prototype.concat,
 
 - (void)removeObjectsInRange:(CPRange)aRange
 {
+    if (aRange.location < 0 || CPMaxRange(aRange) > self.length)
+        [CPException raise:CPRangeException reason:_cmd + " aRange out of bounds"];
+
     splice.call(self, aRange.location, aRange.length);
 }
 
 - (void)replaceObjectAtIndex:(int)anIndex withObject:(id)anObject
 {
+    if (anIndex >= self.length || anIndex < 0)
+        _CPRaiseRangeException(self, _cmd, anIndex, self.length);
+
     self[anIndex] = anObject;
 }
 
 - (void)replaceObjectsInRange:(CPRange)aRange withObjectsFromArray:(CPArray)anArray range:(CPRange)otherRange
 {
+    if (aRange.location < 0 || CPMaxRange(aRange) > self.length)
+        [CPException raise:CPRangeException reason:_cmd + " aRange out of bounds"];
+
+    if (otherRange.location < 0 || CPMaxRange(otherRange) > anArray.length)
+        [CPException raise:CPRangeException reason:_cmd + " otherRange out of bounds"];
+
     if (otherRange && (otherRange.location !== 0 || otherRange.length !== [anArray count]))
         anArray = [anArray subarrayWithRange:otherRange];