diff options
| author | Yukihiro "Matz" Matsumoto <[email protected]> | 2017-04-21 08:55:19 +0900 |
|---|---|---|
| committer | Yukihiro "Matz" Matsumoto <[email protected]> | 2017-04-21 08:55:19 +0900 |
| commit | 262fbaf566cc5eb8c375adde01a427a832f8d9c2 (patch) | |
| tree | 44a326fda4d3ec64b77779fb417df6e7b782532a /src/numeric.c | |
| parent | 3567b262227c6188da21bac2896eea4587bd1de5 (diff) | |
| download | mruby-262fbaf566cc5eb8c375adde01a427a832f8d9c2.tar.gz mruby-262fbaf566cc5eb8c375adde01a427a832f8d9c2.zip | |
`mrb_int` may overflow in bit-shifting; fix #3620
Diffstat (limited to 'src/numeric.c')
| -rw-r--r-- | src/numeric.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/numeric.c b/src/numeric.c index b4b85a9c6..3c8729a0c 100644 --- a/src/numeric.c +++ b/src/numeric.c @@ -938,7 +938,9 @@ fix_xor(mrb_state *mrb, mrb_value x) static mrb_value lshift(mrb_state *mrb, mrb_int val, mrb_int width) { - mrb_assert(width > 0); + if (width < 0) { /* mrb_int overflow */ + return mrb_float_value(mrb, INFINITY); + } if (val > 0) { if ((width > NUMERIC_SHIFT_WIDTH_MAX) || (val > (MRB_INT_MAX >> width))) { @@ -967,7 +969,9 @@ bit_overflow: static mrb_value rshift(mrb_int val, mrb_int width) { - mrb_assert(width > 0); + if (width < 0) { /* mrb_int overflow */ + return mrb_fixnum_value(0); + } if (width >= NUMERIC_SHIFT_WIDTH_MAX) { if (val < 0) { return mrb_fixnum_value(-1); |