Files
Yukihiro "Matz" Matsumoto 9982bc1223 random.c: fix signed integer overflow in rand() with integer ranges
rand_range_int() computed `end - begin + 1` in mrb_int before checking
for a reversed or empty range. For extreme bounds the subtraction itself
overflowed mrb_int (UndefinedBehaviorSanitizer signed-integer-overflow),
and the wraparound could turn a reversed range into a positive span,
defeating the guard.

Reject reversed or empty ranges before subtracting, and compute the
candidate count in unsigned arithmetic, so no signed overflow is
possible. A new unsigned uniform sampler draws from the full mrb_int
domain, so valid ranges whose width exceeds MRB_INT_MAX now return a
uniform in-range value instead of nil, matching CRuby.

Co-authored-by: Claude <noreply@anthropic.com>
2026-06-05 11:23:43 +09:00
..
2026-04-23 19:25:21 +09:00
2024-09-24 00:14:24 +10:00