ash: check range of bits argument.

mp_shift takes an int argument, but we decode bits to
a cnum, leaving possible room for overflow, such as
when cnum is 64 bits and int is 32. If the value

* arith.c (ash): Check that the value is in the range
of INT_MIN to INT_MAX.

1 files changed, 5 insertions, 0 deletions

diff --git a/arith.c b/arith.c
index 93341d3c..8f268f95 100644
--- a/arith.c
+++ b/arith.c
@@ -2446,6 +2446,8 @@ val ash(val a, val bits)
       a = bignum(an);
       /* fallthrough */
     case BGNUM:
+      if (bn < INT_MIN || bn > INT_MAX)
+        goto bad4;
       b = make_bignum();
       if (mp_shift(mp(a), mp(b), bn) != MP_OKAY)
         goto bad;
@@ -2480,6 +2482,9 @@ bad2:
 
 bad3:
   uw_throwf(error_s, lit("ash: non-integral operand ~s"), a, nao);
+
+bad4:
+  uw_throwf(error_s, lit("ash: bit value too large ~s"), bits, nao);
 }
 
 val bit(val a, val bit)