admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

mruby-rational: fix left shift overflow in rational_new_f

Browse Source 
Shifting 1 left by MRB_INT_BIT-1 (e.g., 63 on 64-bit) bits into the sign
bit is undefined behavior. Change the overflow check from >= MRB_INT_BIT
to >= MRB_INT_BIT-1 to prevent this.

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2026-01-05 17:47:56 +09:00
parent d5c7a906f9
commit bbcadd6bf9
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-rational/src/rational.c
+3 -3
View File
@@ -342,8 +342,8 @@ rational_new_f(mrb_state *mrb, mrb_float f)
if (exp > 0) {
mrb_int temp;
/* Check exp < MRB_INT_BIT to avoid undefined behavior from shifting */
if (exp >= MRB_INT_BIT || mrb_int_mul_overflow(nume, ((mrb_int)1)<<exp, &temp)) {
/* Check exp < MRB_INT_BIT-1 to avoid undefined behavior from shifting into sign bit */
if (exp >= MRB_INT_BIT - 1 || mrb_int_mul_overflow(nume, ((mrb_int)1)<<exp, &temp)) {
#ifndef RAT_BIGINT
rat_overflow(mrb);
#else
@@ -356,7 +356,7 @@ rational_new_f(mrb_state *mrb, mrb_float f)
else if (exp < 0) {
/* exp is negative, so we need to multiply denominator by 2^(-exp) */
int neg_exp = -exp;
if (neg_exp >= MRB_INT_BIT || mrb_int_mul_overflow(deno, ((mrb_int)1)<<neg_exp, &deno)) {
if (neg_exp >= MRB_INT_BIT - 1 || mrb_int_mul_overflow(deno, ((mrb_int)1)<<neg_exp, &deno)) {
#ifndef RAT_BIGINT
rat_overflow(mrb);
#else