fixed two Array Bound Writes

git-svn-id: svn://scm.gforge.inria.fr/svn/mpfr/trunk@759 280ebfd0-de03-0410-8827-d642c229c3f4

1 files changed, 2 insertions, 2 deletions

diff --git a/sub.c b/sub.c
index 469555dfc..654b35cfe 100644
--- a/sub.c
+++ b/sub.c
@@ -253,11 +253,11 @@ mpfr_sub1(a, b, c, rnd_mode, diff_exp)
 	if (cn >= k+1)
 	  ap[0] += cp[cn-k-1]>>(BITS_PER_MP_LIMB+dif);
       }
-      else MPN_COPY(ap, cp+(cn-k), k);
+      else MPN_COPY(ap, cp+(cn-k), (k<=an) ? k : an);
       overlap=1;
     }
     else { /* c is not truncated, but we have to fill low limbs with 0 */
-      MPN_ZERO(ap, k-cn);
+      MPN_ZERO(ap, (k-cn<an) ? k-cn : an);
       overlap = cancel-diff_exp;
 #ifdef DEBUG
       printf("0:a="); mpfr_print_raw(a); putchar('\n');