From 070bef24ab84179960f0083d7b62dc9355954230 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Sun, 15 Feb 2026 22:25:38 +0900 Subject: [PATCH] mruby-numeric-ext: fix integer overflow in Integer#lcm check for overflow using mrb_int_mul_overflow() in the LCM computation to avoid undefined behavior when the result exceeds mrb_int range. raises RangeError instead. reported by OSS-Fuzz (clusterfuzz-testcase-6501272051318784). Co-authored-by: Claude --- mrbgems/mruby-numeric-ext/src/numeric_ext.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/mrbgems/mruby-numeric-ext/src/numeric_ext.c b/mrbgems/mruby-numeric-ext/src/numeric_ext.c index 59d122579..a29f0a4bd 100644 --- a/mrbgems/mruby-numeric-ext/src/numeric_ext.c +++ b/mrbgems/mruby-numeric-ext/src/numeric_ext.c @@ -162,7 +162,11 @@ int_lcm(mrb_state *mrb, mrb_value x) if (a < 0) a = -a; if (b < 0) b = -b; - return mrb_int_value(mrb, (a / gcd_val) * b); + mrb_int lcm_val; + if (mrb_int_mul_overflow(a / gcd_val, b, &lcm_val)) { + mrb_int_overflow(mrb, "lcm"); + } + return mrb_int_value(mrb, lcm_val); } /*