From a9825e92df83dc73038673674ec5ed050d2b0521 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Sat, 3 Jan 2026 13:13:02 +0900 Subject: [PATCH] mruby-rational: fix crash in rational_new_f with negative exponent rational_new_b() expects both arguments to be bigints, but rational_new_f() was passing an integer value for the numerator when the exponent was negative. This caused a segfault in mrb_bint_reduce() which called RBIGINT() on the integer value. Test case: 5r**-92 (from oss-fuzz) Co-authored-by: Claude --- mrbgems/mruby-rational/src/rational.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mrbgems/mruby-rational/src/rational.c b/mrbgems/mruby-rational/src/rational.c index fff29b876..05dcd40f4 100644 --- a/mrbgems/mruby-rational/src/rational.c +++ b/mrbgems/mruby-rational/src/rational.c @@ -361,7 +361,7 @@ rational_new_f(mrb_state *mrb, mrb_float f) rat_overflow(mrb); #else mrb_value d = mrb_bint_lshift(mrb, mrb_bint_new_int(mrb, deno), neg_exp); - return rational_new_b(mrb, mrb_int_value(mrb, nume), d); + return rational_new_b(mrb, mrb_bint_new_int(mrb, nume), d); #endif } }