53820: detect integer overflow when parsing history word designators.

2 files changed, 10 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index 12797ff88..70f84ae15 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2025-07-13  Bart Schaefer  <schaefer@zsh.org>
+
+	* 53820: Src/hist.c: detect integer overflow when parsing
+	history word designators.
+
 2025-06-01  Jun-ichi Takimoto  <takimoto-j@kba.biglobe.ne.jp>
 
 	* 53807: Completion/Darwin/Command/_nettop: new completion
diff --git a/Src/hist.c b/Src/hist.c
index 00bdbb2b8..4e4a20e31 100644
--- a/Src/hist.c
+++ b/Src/hist.c
@@ -1800,6 +1800,11 @@ getargspec(int argc, int marg, int evset)
 	ret = 0;
 	while (idigit(c)) {
 	    ret = ret * 10 + c - '0';
+	    if (ret < 0) {
+		herrflush();
+		zerr("no such word in event");
+		return -2;
+	    }
 	    c = ingetc();
 	}
 	inungetc(c);