diff --git a/ruby-1.8.6.230-p257.patch b/ruby-1.8.6.230-p257.patch
new file mode 100644
index 0000000..dbae14a
--- /dev/null
+++ b/ruby-1.8.6.230-p257.patch
@@ -0,0 +1,12 @@
+diff -pruN ruby-1.8.6-p230.orig/array.c ruby-1.8.6-p230/array.c
+--- ruby-1.8.6-p230.orig/array.c	2008-07-01 16:32:12.000000000 +0900
++++ ruby-1.8.6-p230/array.c	2008-07-01 16:34:01.000000000 +0900
+@@ -2272,7 +2272,7 @@ rb_ary_fill(argc, argv, ary)
+ 	break;
+     }
+     rb_ary_modify(ary);
+-    if (len > ARY_MAX_SIZE - beg) {
++    if (beg >= ARY_MAX_SIZE || len > ARY_MAX_SIZE - beg) {
+ 	rb_raise(rb_eArgError, "argument too big");
+     }
+     end = beg + len;
diff --git a/ruby.spec b/ruby.spec
index 07f1c67..14fd705 100644
--- a/ruby.spec
+++ b/ruby.spec
@@ -12,7 +12,7 @@
 
 Name:		ruby
 Version:	%{rubyver}%{?dotpatchlevel}
-Release:	3%{?dist}
+Release:	4%{?dist}
 License:	Ruby or GPLv2
 URL:		http://www.ruby-lang.org/
 BuildRoot:	%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -37,6 +37,7 @@ Patch25:	ruby-1.8.6.111-gcc43.patch
 Patch26:	ruby-1.8.6.230-string-str_buf_cat.patch
 Patch27:	ruby-1.8.6.230-p238.patch
 Patch28:	ruby-1.8.6.230-p248.patch
+patch29:	ruby-1.8.6.230-p257.patch
 
 Summary:	An interpreter of object-oriented scripting language
 Group:		Development/Languages
@@ -158,6 +159,7 @@ pushd %{name}-%{arcver}
 %patch26 -p1
 %patch27 -p1
 %patch28 -p1
+%patch29 -p1
 popd
 
 %build
@@ -508,6 +510,9 @@ rm -rf tmp-ruby-docs
 %{_datadir}/emacs/site-lisp/site-start.d/ruby-mode-init.el
 
 %changelog
+* Tue Jul  1 2008 Akira TAGOH <tagoh@redhat.com> - 1.8.6.230-4
+- Backported from upstream SVN to fix a segfault issue with Array#fill.
+
 * Mon Jun 30 2008 Akira TAGOH <tagoh@redhat.com> - 1.8.6.230-3
 - Backported from upstream SVN to fix a segfault issue. (#452825)
 - Backported from upstream SVN to fix an integer overflow in rb_ary_fill.