Bugfix nagative-number lshift() bit overflow

1 files changed, 16 insertions, 3 deletions

diff --git a/src/numeric.c b/src/numeric.c
index e64cd2d8d..41820ff5c 100644
--- a/src/numeric.c
+++ b/src/numeric.c
@@ -821,15 +821,28 @@ static mrb_value
 lshift(mrb_state *mrb, mrb_int val, mrb_int width)
 {
   mrb_assert(width > 0);
-  if ((width > NUMERIC_SHIFT_WIDTH_MAX) ||
-      (val   > (MRB_INT_MAX >> width))) {
+  if (val > 0) {
+    if ((width > NUMERIC_SHIFT_WIDTH_MAX) ||
+        (val   > (MRB_INT_MAX >> width))) {
+      goto bit_overflow;
+    }
+  } else {
+    if ((width > NUMERIC_SHIFT_WIDTH_MAX) ||
+        (val   < (MRB_INT_MIN >> width))) {
+      goto bit_overflow;
+    }
+  }
+
+  return mrb_fixnum_value(val << width);
+
+bit_overflow:
+  {
     mrb_float f = (mrb_float)val;
     while (width--) {
       f *= 2;
     }
     return mrb_float_value(mrb, f);
   }
-  return mrb_fixnum_value(val << width);
 }
 
 static mrb_value