Summary

In src/fp_uscale.c, mrb_read_float() (also used by the obsolete wrapper mrb_float_read() in src/readnum.c) parses the integer part with a signed int trunc counter that increments for every digit beyond the first 19:

while (ISDIGIT(*p)) {
  if (nd < 19) {
    d = d * 10 + (*p - '0');
    nd++;
  }
  else {
    trunc++;
  }
  ...
}

There is no upper bound on trunc. A numeric string with more than about INT_MAX + 19 digits therefore triggers signed integer overflow (undefined behavior in C) while scanning digits.

Impact

• C signed-overflow UB during float parsing of an extremely long digit string.
• Practical trigger is resource-heavy (huge input), but the missing bound is a real source defect.
• mrb_float_read() itself is marked obsolete and now just calls mrb_read_float(); the overflow sits in the shared parser.

Affected

• File: src/fp_uscale.c (mrb_read_float)
• Also reachable via: src/readnum.c (mrb_float_read wrapper)
• Version tested: latest master @ c04daf59b41d