From 1cdf8ab07b24ebd16e93621957196e8b1d67f2ba Mon Sep 17 00:00:00 2001
From: Nobuyoshi Nakada <nobu@ruby-lang.org>
Date: Sun, 8 Jan 2023 20:54:48 +0900
Subject: [Bug #19323] Raise `RangeError` instead of integer overflow

---
 bignum.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'bignum.c')

diff --git a/bignum.c b/bignum.c
index 4f8349dd17..a1a659db09 100644
--- a/bignum.c
+++ b/bignum.c
@@ -4587,11 +4587,14 @@ big_shift3(VALUE x, int lshift_p, size_t shift_numdigits, int shift_numbits)
 
     if (lshift_p) {
         if (LONG_MAX < shift_numdigits) {
-            rb_raise(rb_eArgError, "too big number");
+          too_big:
+            rb_raise(rb_eRangeError, "shift width too big");
         }
         s1 = shift_numdigits;
         s2 = shift_numbits;
+        if ((size_t)s1 != shift_numdigits) goto too_big;
         xn = BIGNUM_LEN(x);
+        if (LONG_MAX/SIZEOF_BDIGIT <= xn+s1) goto too_big;
         z = bignew(xn+s1+1, BIGNUM_SIGN(x));
         zds = BDIGITS(z);
         BDIGITS_ZERO(zds, s1);
-- 
cgit v1.2.3