tkutil.c: fix out-of-bounds access

* ext/tk/tkutil/tkutil.c (cbsubst_table_setup): check array
  length not access out-of-bounds.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@50708 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

ext/tk/tkutil/tkutil.c

@@ -1617,6 +1617,7 @@ cbsubst_table_setup(argc, argv, self)
   for(idx = 0; idx < len; idx++) {
     inf = RARRAY_PTR(proc_inf)[idx];
     if (!RB_TYPE_P(inf, T_ARRAY)) continue;
+    if (RARRAY_LEN(inf) < 2) continue;
     rb_hash_aset(subst_inf->proc,
 		 (RB_TYPE_P(RARRAY_PTR(inf)[0], T_STRING)?
 		  INT2FIX(*(RSTRING_PTR(RARRAY_PTR(inf)[0]))) :