From a4d5588101979a49f842c8a2f1ea710adb788d0d Mon Sep 17 00:00:00 2001
From: murase_syuka <murase.syuka+github@gmail.com>
Date: Wed, 18 Nov 2015 00:15:47 +0900
Subject: Bugfix lshift() bit overflow; close #3023

---
 src/numeric.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'src/numeric.c')

diff --git a/src/numeric.c b/src/numeric.c
index 6cceaeb9e..e64cd2d8d 100644
--- a/src/numeric.c
+++ b/src/numeric.c
@@ -821,7 +821,8 @@ static mrb_value
 lshift(mrb_state *mrb, mrb_int val, mrb_int width)
 {
   mrb_assert(width > 0);
-  if (width > NUMERIC_SHIFT_WIDTH_MAX) {
+  if ((width > NUMERIC_SHIFT_WIDTH_MAX) ||
+      (val   > (MRB_INT_MAX >> width))) {
     mrb_float f = (mrb_float)val;
     while (width--) {
       f *= 2;
-- 
cgit v1.2.3