From 584c3b6465ec40226687e9699d2b652d9ad31a8f Mon Sep 17 00:00:00 2001
From: Randy Stauner <randy@r4s6.net>
Date: Mon, 9 Feb 2026 10:47:03 -0700
Subject: [Backport #21866] Fix integer overflow checks in enumerator (#16088)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix integer overflow checks in enumerator

Co-authored-by: Jörmungandrk <github@zerodaysec.org>
---
 enumerator.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/enumerator.c b/enumerator.c
index 89ec503530..63a665c686 100644
--- a/enumerator.c
+++ b/enumerator.c
@@ -18,6 +18,7 @@
 #include <float.h>
 #endif
 
+#include <limits.h>
 #include "id.h"
 #include "internal.h"
 #include "internal/class.h"
@@ -4000,7 +4001,7 @@ arith_seq_take(VALUE self, VALUE num)
             ary = rb_ary_new_capa((n < len) ? n : len);
             while (n > 0 && i < end) {
                 rb_ary_push(ary, LONG2FIX(i));
-                if (i + unit < i) break;
+                if (i > LONG_MAX - unit) break;
                 i += unit;
                 --n;
             }
@@ -4013,7 +4014,7 @@ arith_seq_take(VALUE self, VALUE num)
             ary = rb_ary_new_capa((n < len) ? n : len);
             while (n > 0 && i > end) {
                 rb_ary_push(ary, LONG2FIX(i));
-                if (i + unit > i) break;
+                if (i < LONG_MIN - unit) break;
                 i += unit;
                 --n;
             }
-- 
cgit v1.2.3