Yukihiro "Matz" Matsumoto 5eca2fae1e rational.c: fix undefined behavior from large shift exponents ...

In rational_new_f(), the code performed ((mrb_int)1)<<exp without
checking if exp >= MRB_INT_BIT. Shifting by a value >= bit width
is undefined behavior in C.

Also fixed the negative exponent case which incorrectly used
deno >>= exp (right-shift by negative is UB). The correct logic
is deno <<= -exp to multiply denominator by 2^(-exp).

Both cases now check for overflow before shifting and fall back
to bigint operations when necessary.

Discovered via ClusterFuzz with input "92r**11".

Co-authored-by: Claude <noreply@anthropic.com>

2025-12-30 14:28:44 +09:00

..

rational.c

rational.c: fix undefined behavior from large shift exponents

2025-12-30 14:28:44 +09:00