mruby-rational: fix crash in rational_new_f with negative exponent

rational_new_b() expects both arguments to be bigints, but rational_new_f()
was passing an integer value for the numerator when the exponent was negative.
This caused a segfault in mrb_bint_reduce() which called RBIGINT() on the
integer value.

Test case: 5r**-92 (from oss-fuzz)

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2026-01-03 13:13:02 +09:00
parent 53a25bab14
commit a9825e92df
+1 -1
View File
@@ -361,7 +361,7 @@ rational_new_f(mrb_state *mrb, mrb_float f)
rat_overflow(mrb);
#else
mrb_value d = mrb_bint_lshift(mrb, mrb_bint_new_int(mrb, deno), neg_exp);
return rational_new_b(mrb, mrb_int_value(mrb, nume), d);
return rational_new_b(mrb, mrb_bint_new_int(mrb, nume), d);
#endif
}
}