From 51a3317c5babfe8ecb44c72528aba5cd6f119b0c Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby.or.jp>
Date: Wed, 2 Mar 2022 15:34:28 +0900
Subject: [PATCH] string.c: check integer overflow using
 `mrb_int_mul_overflow()`.

---
 src/string.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/string.c b/src/string.c
index 332c4e777..890300432 100644
--- a/src/string.c
+++ b/src/string.c
@@ -928,11 +928,9 @@ mrb_str_times(mrb_state *mrb, mrb_value self)
   if (times < 0) {
     mrb_raise(mrb, E_ARGUMENT_ERROR, "negative argument");
   }
-  if (times && MRB_SSIZE_MAX / times < RSTRING_LEN(self)) {
+  if (mrb_int_mul_overflow(RSTRING_LEN(self), times, &len)) {
     mrb_raise(mrb, E_ARGUMENT_ERROR, "argument too big");
   }
-
-  len = RSTRING_LEN(self)*times;
   str2 = str_new(mrb, 0, len);
   p = RSTR_PTR(str2);
   if (len > 0) {