diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2020-11-26 20:45:06 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2020-11-26 20:48:25 +0900 |
| commit | e0b8876640592400bb0160be2f63e6b54c0ce3cc (patch) | |
| tree | cc23a755491e24a2aac91851daf7c8a46f2aeb30 | |
| parent | 79af3f30b4a138d73adc13dff4cda5ec95d8f438 (diff) | |
| download | mruby-e0b8876640592400bb0160be2f63e6b54c0ce3cc.tar.gz mruby-e0b8876640592400bb0160be2f63e6b54c0ce3cc.zip | |
Avoid integer overflow in `rational_new`.
| -rw-r--r-- | mrbgems/mruby-rational/src/rational.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/mrbgems/mruby-rational/src/rational.c b/mrbgems/mruby-rational/src/rational.c index 85b1dff07..23d70fc04 100644 --- a/mrbgems/mruby-rational/src/rational.c +++ b/mrbgems/mruby-rational/src/rational.c @@ -77,6 +77,9 @@ rational_new(mrb_state *mrb, mrb_int numerator, mrb_int denominator) struct mrb_rational *p; struct RBasic *rat = rational_alloc(mrb, c, &p); if (denominator < 0) { + if (numerator == MRB_INT_MIN || denominator == MRB_INT_MIN) { + mrb_raise(mrb, E_RANGE_ERROR, "integer overflow in rational"); + } numerator *= -1; denominator *= -1; } @@ -115,6 +118,9 @@ rational_new_f(mrb_state *mrb, mrb_float f0) if (f < 0) { neg = 1; f = -f; } while (f != floor(f)) { n <<= 1; f *= 2; } + if (!TYPED_FIXABLE(f, rat_float)) { + mrb_raise(mrb, E_RANGE_ERROR, "integer overflow in rational"); + } d = (mrb_int)f; /* continued fraction and check denominator each step */ |