5 files changed, 21 insertions, 13 deletions

diff --git a/bignum.c b/bignum.c
index 868c5dba88..144970bba9 100644
--- a/bignum.c
+++ b/bignum.c
@@ -2587,10 +2587,9 @@ bigdivrem_single1(BDIGIT *qds, const BDIGIT *xds, size_t xn, BDIGIT x_higher_bdi
         size_t i;
         BDIGIT_DBL t2;
         t2 = x_higher_bdigit;
-        i = xn;
-        while (i--) {
-            t2 = BIGUP(t2) + xds[i];
-            qds[i] = (BDIGIT)(t2 / y);
+        for (i = 0; i < xn; i++) {
+            t2 = BIGUP(t2) + xds[xn - i - 1];
+            qds[xn - i - 1] = (BDIGIT)(t2 / y);
             t2 %= y;
         }
         return (BDIGIT)t2;
diff --git a/cont.c b/cont.c
index 7a24ec5e53..d98326db6b 100644
--- a/cont.c
+++ b/cont.c
@@ -1199,7 +1199,7 @@ rollback_ensure_stack(VALUE self,rb_ensure_list_t *current,rb_ensure_entry_t *ta
 {
     rb_ensure_list_t *p;
     rb_ensure_entry_t *entry;
-    size_t i;
+    size_t i, j;
     size_t cur_size;
     size_t target_size;
     size_t base_point;
@@ -1237,11 +1237,11 @@ rollback_ensure_stack(VALUE self,rb_ensure_list_t *current,rb_ensure_entry_t *ta
 	cur_size--;
     }
     /* push ensure stack */
-    while (i--) {
-	func = (VALUE (*)(ANYARGS)) lookup_rollback_func(target[i].e_proc);
-	if ((VALUE)func != Qundef) {
-	    (*func)(target[i].data2);
-	}
+    for (j = 0; j < i; j++) {
+        func = (VALUE (*)(ANYARGS)) lookup_rollback_func(target[i - j - 1].e_proc);
+        if ((VALUE)func != Qundef) {
+            (*func)(target[i - j - 1].data2);
+        }
     }
 }
 
diff --git a/random.c b/random.c
index 16f2453b69..4f6d51dffa 100644
--- a/random.c
+++ b/random.c
@@ -1573,6 +1573,7 @@ init_seed(struct MT *mt)
 	seed.u32[i] = genrand_int32(mt);
 }
 
+NO_SANITIZE("unsigned-integer-overflow", extern st_index_t rb_hash_start(st_index_t h));
 st_index_t
 rb_hash_start(st_index_t h)
 {
diff --git a/util.c b/util.c
index 9835d7f3c4..ea68110527 100644
--- a/util.c
+++ b/util.c
@@ -54,8 +54,16 @@ ruby_scan_hex(const char *start, size_t len, size_t *retlen)
     register const char *s = start;
     register unsigned long retval = 0;
     const char *tmp;
+    size_t i = 0;
 
-    while (len-- && *s && (tmp = strchr(hexdigit, *s))) {
+    for (i = 0; i < len; i++) {
+        if (! s[0]) {
+            break;
+        }
+        tmp = strchr(hexdigit, *s);
+        if (! tmp) {
+            break;
+        }
 	retval <<= 4;
 	retval |= (tmp - hexdigit) & 15;
 	s++;
diff --git a/vm_insnhelper.c b/vm_insnhelper.c
index 7fb18714dd..ef4c938fc5 100644
--- a/vm_insnhelper.c
+++ b/vm_insnhelper.c
@@ -3211,7 +3211,7 @@ vm_opt_newarray_max(rb_num_t num, const VALUE *ptr)
 	else {
 	    struct cmp_opt_data cmp_opt = { 0, 0 };
 	    VALUE result = *ptr;
-	    rb_num_t i = num - 1;
+            rb_snum_t i = num - 1;
 	    while (i-- > 0) {
 		const VALUE v = *++ptr;
 		if (OPTIMIZED_CMP(v, result, cmp_opt) > 0) {
@@ -3237,7 +3237,7 @@ vm_opt_newarray_min(rb_num_t num, const VALUE *ptr)
 	else {
 	    struct cmp_opt_data cmp_opt = { 0, 0 };
 	    VALUE result = *ptr;
-	    rb_num_t i = num - 1;
+            rb_snum_t i = num - 1;
 	    while (i-- > 0) {
 		const VALUE v = *++ptr;
 		if (OPTIMIZED_CMP(v, result, cmp_opt) < 0) {