From ef5d93d4eaaaf107094776c215f07efd0faae3e9 Mon Sep 17 00:00:00 2001
From: INADA Naoki <inada-n@klab.com>
Date: Wed, 26 Mar 2014 11:05:53 +0900
Subject: [PATCH] Fix size limit on pack_array_header and pack_map_header.

---
 msgpack/_packer.pyx | 4 ++--
 msgpack/fallback.py | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/msgpack/_packer.pyx b/msgpack/_packer.pyx
index 204beaa..82e4a63 100644
--- a/msgpack/_packer.pyx
+++ b/msgpack/_packer.pyx
@@ -238,7 +238,7 @@ cdef class Packer(object):
         msgpack_pack_raw_body(&self.pk, data, len(data))
 
     def pack_array_header(self, size_t size):
-        if size >= (2**32-1):
+        if size > (2**32-1):
             raise ValueError
         cdef int ret = msgpack_pack_array(&self.pk, size)
         if ret == -1:
@@ -251,7 +251,7 @@ cdef class Packer(object):
             return buf
 
     def pack_map_header(self, size_t size):
-        if size >= (2**32-1):
+        if size > (2**32-1):
             raise ValueError
         cdef int ret = msgpack_pack_map(&self.pk, size)
         if ret == -1:
diff --git a/msgpack/fallback.py b/msgpack/fallback.py
index 55de72c..49323e6 100644
--- a/msgpack/fallback.py
+++ b/msgpack/fallback.py
@@ -633,6 +633,8 @@ class Packer(object):
         return ret
 
     def pack_array_header(self, n):
+        if n >= 2**32:
+            raise ValueError
         self._fb_pack_array_header(n)
         ret = self._buffer.getvalue()
         if self._autoreset:
@@ -642,6 +644,8 @@ class Packer(object):
         return ret
 
     def pack_map_header(self, n):
+        if n >= 2**32:
+            raise ValueError
         self._fb_pack_map_header(n)
         ret = self._buffer.getvalue()
         if self._autoreset: