diff --git a/bash-4.2-size_type.patch b/bash-4.2-size_type.patch
new file mode 100644
index 0000000..ab56677
--- /dev/null
+++ b/bash-4.2-size_type.patch
@@ -0,0 +1,14 @@
+diff -up bash-4.2/variables.h.size_type bash-4.2/variables.h
+--- bash-4.2/variables.h.size_type	2012-11-29 10:33:25.109036844 +0100
++++ bash-4.2/variables.h	2012-11-29 10:46:12.718530162 +0100
+@@ -95,8 +95,8 @@ typedef struct variable {
+ 
+ typedef struct _vlist {
+   SHELL_VAR **list;
+-  int list_size;	/* allocated size */
+-  int list_len;		/* current number of entries */
++  size_t list_size;	/* allocated size */
++  size_t list_len;	/* current number of entries */
+ } VARLIST;
+ 
+ /* The various attributes that a given variable can have. */
diff --git a/bash.spec b/bash.spec
index 22ac802..be7d6cb 100644
--- a/bash.spec
+++ b/bash.spec
@@ -6,7 +6,7 @@
 Version: %{baseversion}%{patchleveltag}
 Name: bash
 Summary: The GNU Bourne Again shell
-Release: 2%{?dist}
+Release: 3%{?dist}
 Group: System Environment/Shells
 License: GPLv3+
 Url: http://www.gnu.org/software/bash
@@ -103,6 +103,9 @@ Patch123: bash-4.2-manpage_trap.patch
 # 695656, block the signal and unblock it after the new handler is installed
 Patch124: bash-4.2-signal.patch
 
+# https://www.securecoding.cert.org/confluence/display/seccode/INT32-C.+Ensure+that+operations+on+signed+integers+do+not+result+in+overflow
+Patch125: bash-4.2-size_type.patch
+
 BuildRequires: texinfo bison
 BuildRequires: ncurses-devel
 BuildRequires: autoconf, gettext
@@ -196,6 +199,7 @@ This package contains documentation files for %{name}.
 %patch122 -p1 -b .defer_sigchld_trap
 %patch123 -p1
 %patch124 -p1 -b .signal
+%patch125 -p1 -b .size_type
 
 echo %{version} > _distribution
 echo %{release} > _patchlevel
@@ -388,6 +392,9 @@ end
 #%doc doc/*.ps doc/*.0 doc/*.html doc/article.txt
 
 %changelog
+* Thu Nov 29 2012 Roman Rakus <rrakus@redhat.com> - 4.2.39-3
+- Use unsigned type for size
+
 * Tue Nov 27 2012 Roman Rakus <rrakus@redhat.com> - 4.2.39-2
 - Create bashbug symlink