Files
mruby-mruby/mrbgems
Yukihiro "Matz" Matsumoto 5eca2fae1e rational.c: fix undefined behavior from large shift exponents
In rational_new_f(), the code performed ((mrb_int)1)<<exp without
checking if exp >= MRB_INT_BIT. Shifting by a value >= bit width
is undefined behavior in C.

Also fixed the negative exponent case which incorrectly used
deno >>= exp (right-shift by negative is UB). The correct logic
is deno <<= -exp to multiply denominator by 2^(-exp).

Both cases now check for overflow before shifting and fall back
to bigint operations when necessary.

Discovered via ClusterFuzz with input "92r**11".

Co-authored-by: Claude <noreply@anthropic.com>
2025-12-30 14:28:44 +09:00
..
2025-10-25 21:05:39 +09:00
2024-09-24 00:14:24 +10:00