bigint.c (udiv): check out of bound memory access.
@@ -458,8 +458,13 @@ udiv(mrb_state *mrb, mpz_t *qq, mpz_t *rr, mpz_t *xx, mpz_t *yy)
mpz_realloc(mrb, &q, xd);
mp_limb2 z = y.p[yd-1];
for (size_t j=xd-yd;; j--) {
- mp_limb2 qhat = (((mp_limb2)x.p[j+yd] << DIG_SIZE) + x.p[j+yd-1]) / z;
mp_limb2s b=0;
+ mp_limb2 qhat;
+
+ if (j+yd == xd)
+ qhat = x.p[j+yd-1] / z;
+ else
+ qhat = (((mp_limb2)x.p[j+yd] << DIG_SIZE) + x.p[j+yd-1]) / z;
if (qhat) {
for (i=0; i<yd; i++) {
mp_limb2 zz = qhat * y.p[i];
