mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
9982bc1223
rand_range_int() computed `end - begin + 1` in mrb_int before checking for a reversed or empty range. For extreme bounds the subtraction itself overflowed mrb_int (UndefinedBehaviorSanitizer signed-integer-overflow), and the wraparound could turn a reversed range into a positive span, defeating the guard. Reject reversed or empty ranges before subtracting, and compute the candidate count in unsigned arithmetic, so no signed overflow is possible. A new unsigned uniform sampler draws from the full mrb_int domain, so valid ranges whose width exceeds MRB_INT_MAX now return a uniform in-range value instead of nil, matching CRuby. Co-authored-by: Claude <noreply@anthropic.com>