From bbcadd6bf991fb9c827c969f5addbdf58aa7c182 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby.or.jp>
Date: Mon, 5 Jan 2026 17:47:56 +0900
Subject: [PATCH] mruby-rational: fix left shift overflow in rational_new_f

Shifting 1 left by MRB_INT_BIT-1 (e.g., 63 on 64-bit) bits into the sign
bit is undefined behavior. Change the overflow check from >= MRB_INT_BIT
to >= MRB_INT_BIT-1 to prevent this.

Co-authored-by: Claude <noreply@anthropic.com>
---
 mrbgems/mruby-rational/src/rational.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mrbgems/mruby-rational/src/rational.c b/mrbgems/mruby-rational/src/rational.c
index 05dcd40f4..7f5135594 100644
--- a/mrbgems/mruby-rational/src/rational.c
+++ b/mrbgems/mruby-rational/src/rational.c
@@ -342,8 +342,8 @@ rational_new_f(mrb_state *mrb, mrb_float f)
 
   if (exp > 0) {
     mrb_int temp;
-    /* Check exp < MRB_INT_BIT to avoid undefined behavior from shifting */
-    if (exp >= MRB_INT_BIT || mrb_int_mul_overflow(nume, ((mrb_int)1)<<exp, &temp)) {
+    /* Check exp < MRB_INT_BIT-1 to avoid undefined behavior from shifting into sign bit */
+    if (exp >= MRB_INT_BIT - 1 || mrb_int_mul_overflow(nume, ((mrb_int)1)<<exp, &temp)) {
 #ifndef RAT_BIGINT
       rat_overflow(mrb);
 #else
@@ -356,7 +356,7 @@ rational_new_f(mrb_state *mrb, mrb_float f)
   else if (exp < 0) {
     /* exp is negative, so we need to multiply denominator by 2^(-exp) */
     int neg_exp = -exp;
-    if (neg_exp >= MRB_INT_BIT || mrb_int_mul_overflow(deno, ((mrb_int)1)<<neg_exp, &deno)) {
+    if (neg_exp >= MRB_INT_BIT - 1 || mrb_int_mul_overflow(deno, ((mrb_int)1)<<neg_exp, &deno)) {
 #ifndef RAT_BIGINT
       rat_overflow(mrb);
 #else