mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
mruby-rational: fix crash in rational_new_f with negative exponent
rational_new_b() expects both arguments to be bigints, but rational_new_f() was passing an integer value for the numerator when the exponent was negative. This caused a segfault in mrb_bint_reduce() which called RBIGINT() on the integer value. Test case: 5r**-92 (from oss-fuzz) Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
@@ -361,7 +361,7 @@ rational_new_f(mrb_state *mrb, mrb_float f)
|
||||
rat_overflow(mrb);
|
||||
#else
|
||||
mrb_value d = mrb_bint_lshift(mrb, mrb_bint_new_int(mrb, deno), neg_exp);
|
||||
return rational_new_b(mrb, mrb_int_value(mrb, nume), d);
|
||||
return rational_new_b(mrb, mrb_bint_new_int(mrb, nume), d);
|
||||
#endif
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user