From 9fcfd01f205fdd092be0932ac0b7a6a4eb29d2b3 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby.or.jp>
Date: Thu, 10 Nov 2022 22:21:12 +0900
Subject: [PATCH] mruby-pack/pack.c (read_tmpl): check integer overflow before
 casting.

---
 mrbgems/mruby-pack/src/pack.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mrbgems/mruby-pack/src/pack.c b/mrbgems/mruby-pack/src/pack.c
index 08c22b5eb..9999e0ef7 100644
--- a/mrbgems/mruby-pack/src/pack.c
+++ b/mrbgems/mruby-pack/src/pack.c
@@ -1306,7 +1306,7 @@ alias:
     if (ISDIGIT(ch)) {
       char *e;
       mrb_int n;
-      if (!mrb_read_int(tptr+tmpl->idx, tptr+tlen, &e, &n)) {
+      if (!mrb_read_int(tptr+tmpl->idx, tptr+tlen, &e, &n) || INT_MAX < n) {
         mrb_raise(mrb, E_RUNTIME_ERROR, "too big template length");
       }
       count = (int)n;