mruby-pack/pack.c (read_tmpl): check integer overflow before casting.
@@ -1306,7 +1306,7 @@ alias:
if (ISDIGIT(ch)) {
char *e;
mrb_int n;
- if (!mrb_read_int(tptr+tmpl->idx, tptr+tlen, &e, &n)) {
+ if (!mrb_read_int(tptr+tmpl->idx, tptr+tlen, &e, &n) || INT_MAX < n) {
mrb_raise(mrb, E_RUNTIME_ERROR, "too big template length");
}
count = (int)n;
