4 files changed, 10 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index f0f223ec77..cd5c3e04a5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+Mon Apr 18 16:56:31 2016  Benoit Daloze  <[email protected]>
+
+	* thread.c (update_coverage): Do not track coverage in loaded files
+	  after Coverage.result. Avoids out-of-bounds access. [Bug #12237]
+
+	* ext/coverage/coverage.c (coverage_clear_result_i): document.
+
 Mon Apr 18 16:33:50 2016  Nobuyoshi Nakada  <[email protected]>
 
 	* ext/date/date_core.c (Init_date_core): [DOC] fix misplaced doc
diff --git a/ext/coverage/coverage.c b/ext/coverage/coverage.c
index 0c7755bc6d..f621280ca6 100644
--- a/ext/coverage/coverage.c
+++ b/ext/coverage/coverage.c
@@ -32,6 +32,7 @@ rb_coverage_start(VALUE klass)
     return Qnil;
 }
 
+/* Make coverage arrays empty so old covered files are no longer tracked. */
 static int
 coverage_clear_result_i(st_data_t key, st_data_t val, st_data_t h)
 {
diff --git a/thread.c b/thread.c
index c2ce8274e5..4e0340d801 100644
--- a/thread.c
+++ b/thread.c
@@ -4768,7 +4768,7 @@ update_coverage(rb_event_flag_t event, VALUE proc, VALUE self, ID id, VALUE klas
     if (coverage && RBASIC(coverage)->klass == 0) {
 	long line = rb_sourceline() - 1;
 	long count;
-	if (RARRAY_AREF(coverage, line) == Qnil) {
+	if (line >= RARRAY_LEN(coverage)) { /* no longer tracked */
 	    return;
 	}
 	count = FIX2LONG(RARRAY_AREF(coverage, line)) + 1;
diff --git a/version.h b/version.h
index 2a38134dca..acd23fec52 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
 #define RUBY_VERSION "2.3.0"
 #define RUBY_RELEASE_DATE "2016-04-18"
-#define RUBY_PATCHLEVEL 87
+#define RUBY_PATCHLEVEL 88
 
 #define RUBY_RELEASE_YEAR 2016
 #define RUBY_RELEASE_MONTH 4