merge revision(s) 54172: [Backport #12192]

	* parse.y (parse_numvar): NTH_REF must be less than a half of
	  INT_MAX, as it is left-shifted to be ORed with back-ref flag.
	  [ruby-core:74444] [Bug#12192] [Fix GH-1296]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_3@54382 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

3 files changed, 8 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 2ce5d1e34f..9261a445ee 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Tue Mar 29 16:45:58 2016  Victor Nawothnig  <Victor.Nawothnig@gmail.com>
+
+	* parse.y (parse_numvar): NTH_REF must be less than a half of
+	  INT_MAX, as it is left-shifted to be ORed with back-ref flag.
+	  [ruby-core:74444] [Bug#12192] [Fix GH-1296]
+
 Tue Mar 29 16:44:54 2016  NARUSE, Yui  <naruse@ruby-lang.org>
 
 	* enc/trans/JIS: update Unicode's notice. [Bug #11844]
diff --git a/parse.y b/parse.y
index 03dcbaa404..1d10f167c7 100644
--- a/parse.y
+++ b/parse.y
@@ -7824,7 +7824,7 @@ parse_numvar(struct parser_params *parser)
     int overflow;
     unsigned long n = ruby_scan_digits(tok()+1, toklen()-1, 10, &len, &overflow);
     const unsigned long nth_ref_max =
-	(FIXNUM_MAX / 2 < INT_MAX) ? FIXNUM_MAX / 2 : INT_MAX;
+	((FIXNUM_MAX < INT_MAX) ? FIXNUM_MAX : INT_MAX) >> 1;
     /* NTH_REF is left-shifted to be ORed with back-ref flag and
      * turned into a Fixnum, in compile.c */
 
diff --git a/version.h b/version.h
index 2795cf4dc5..ba8a795ebf 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
 #define RUBY_VERSION "2.3.0"
 #define RUBY_RELEASE_DATE "2016-03-29"
-#define RUBY_PATCHLEVEL 39
+#define RUBY_PATCHLEVEL 40
 
 #define RUBY_RELEASE_YEAR 2016
 #define RUBY_RELEASE_MONTH 3