* bignum.c (rb_big_aref): check for Bignum index range.

 [ruby-dev:31271]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@12855 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 22 insertions, 12 deletions

diff --git a/bignum.c b/bignum.c
index f5a47871d3..38717e4257 100644
--- a/bignum.c
+++ b/bignum.c
@@ -2151,29 +2151,39 @@ rb_big_aref(x, y)
     VALUE x, y;
 {
     BDIGIT *xds;
-    int shift;
-    long s1, s2;
+    BDIGIT_DBL num;
+    unsigned long shift;
+    long i, s1, s2;
 
     if (TYPE(y) == T_BIGNUM) {
-	if (!RBIGNUM(y)->sign || RBIGNUM(x)->sign)
+	if (!RBIGNUM(y)->sign)
 	    return INT2FIX(0);
-	return INT2FIX(1);
+	if (RBIGNUM(bigtrunc(y))->len > SIZEOF_LONG/SIZEOF_BDIGITS) {
+	  out_of_range:
+	    return RBIGNUM(x)->sign ? INT2FIX(0) : INT2FIX(1);
+	}
+	shift = big2ulong(y, "long", Qfalse);
+    }
+    else {
+	i = NUM2LONG(y);
+	if (i < 0) return INT2FIX(0);
+	shift = (VALUE)i;
     }
-    shift = NUM2INT(y);
-    if (shift < 0) return INT2FIX(0);
     s1 = shift/BITSPERDIG;
     s2 = shift%BITSPERDIG;
 
+    if (s1 >= RBIGNUM(x)->len) goto out_of_range;
     if (!RBIGNUM(x)->sign) {
-	if (s1 >= RBIGNUM(x)->len) return INT2FIX(1);
-	x = rb_big_clone(x);
-	get2comp(x);
+	xds = BDIGITS(x);
+	i = 0; num = 1;
+	while (num += ~xds[i], ++i <= s1) {
+	    num = BIGDN(num);
+	}
     }
     else {
-	if (s1 >= RBIGNUM(x)->len) return INT2FIX(0);
+	num = BDIGITS(x)[s1];
     }
-    xds = BDIGITS(x);
-    if (xds[s1] & (1<<s2))
+    if (num & ((BDIGIT_DBL)1<<s2))
 	return INT2FIX(1);
     return INT2FIX(0);
 }