Bugfix: ash: right shifts of fixnums broken.

* arith.c (ash): The bn <= num_bits comparison
here is always true because bn < 0, leading
to undefined behavior when bn is sufficiently
negative, due to the shift being as wide or
wider than the number of bits in a cnum.

1 files changed, 2 insertions, 1 deletions

diff --git a/arith.c b/arith.c
index d22adb9b..e9ecdf54 100644
--- a/arith.c
+++ b/arith.c
@@ -2432,9 +2432,10 @@ val ash(val a, val bits)
   } else {
     switch (type(a)) {
     case NUM:
+      bn = -bn;
       an = c_num(a);
       if (bn <= num_bits)
-        return num_fast(an >> -bn);
+        return num_fast(an >> bn);
       return num_fast(an >> num_bits);
     case BGNUM:
       b = make_bignum();