bigint.c (mpz_get_int): avoid buffer overflow.
@@ -742,17 +742,21 @@ static int
mpz_get_int(mpz_t *y, mrb_int *v)
{
mp_limb i;
+ size_t d;
if (y->sn == 0) {
i = 0;
}
- else if (digits(y) > 2 || y->p[1] > 1) {
+ else if ((d = digits(y)) > 2 || (d == 2 && y->p[1] > 1)) {
return FALSE;
}
- else {
+ else if (d == 2) {
i = (y->sn * (y->p[0] | (y->p[1] & 1) << DIGITBITS));
- if (MRB_INT_MAX < i || i < MRB_INT_MIN) return FALSE;
}
+ else {/* d == 1 */
+ i = y->sn * y->p[0];
+ }
+ if (MRB_INT_MAX < i || i < MRB_INT_MIN) return FALSE;
*v = i;
return TRUE;
}
