2 files changed, 9 insertions, 1 deletions
diff --git a/ChangeLog b/ChangeLog
index ed63c3cb55..b16355a90d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+Sat Nov  1 17:09:32 2014  Tanaka Akira  <akr@fsij.org>
+
+	* bignum.c (bary_mul_balance_with_mulfunc): Fix free work area
+	  location.
+	  [ruby-dev:48723] [Bug #10464]
+	  [ruby-core:66044] [Bug #10465]
+	  Reported by Kohji Nishihama.
+
 Sat Nov  1 15:45:15 2014  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* parse.y (parse_atmark): mere atmark and two atmarks without
diff --git a/bignum.c b/bignum.c
index efc34bfd93..74ca5b1b8d 100644
--- a/bignum.c
+++ b/bignum.c
@@ -1650,7 +1650,7 @@ bary_mul_balance_with_mulfunc(BDIGIT *zds, size_t zn, const BDIGIT *xds, size_t
             }
             tds = zds + n;
             MEMCPY(wds, zds + n, BDIGIT, xn);
-            mulfunc(tds, tn, xds, xn, yds + n, r, wds-xn, wn-xn);
+            mulfunc(tds, tn, xds, xn, yds + n, r, wds+xn, wn-xn);
             bary_add(zds + n, tn,
                      zds + n, tn,
                      wds, xn);