Fix the integer overflow in `mrb_str_len_to_inum()`.

1 files changed, 5 insertions, 9 deletions

diff --git a/src/string.c b/src/string.c
index 4d09c7eab..0cb9eaf83 100644
--- a/src/string.c
+++ b/src/string.c
@@ -2345,16 +2345,12 @@ mrb_str_len_to_inum(mrb_state *mrb, const char *str, size_t len, mrb_int base, i
     }
     n *= base;
     n += c;
-    if (n > (uint64_t)MRB_INT_MAX + (sign ? 0 : 1)) {
-#ifndef MRB_NO_FLOAT
-      if (base == 10) {
-        return mrb_float_value(mrb, mrb_str_to_dbl(mrb, mrb_str_new(mrb, str, len), badcheck));
-      }
-      else
-#endif
-      {
-        mrb_raisef(mrb, E_RANGE_ERROR, "string (%l) too big for integer", str, pend-str);
+    if (n > (uint64_t)MRB_INT_MAX) {
+      if (sign == 0 && n == (uint64_t)MRB_INT_MIN) {
+        sign = 1;
+        break;
       }
+      mrb_raisef(mrb, E_RANGE_ERROR, "string (%l) too big for integer", str, pend-str);
     }
   }
   val = (mrb_int)n;