diff --git a/ChangeLog b/ChangeLog
index 16dea32c27..92b2edc31a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Tue Jun 21 16:12:21 2016  NARUSE, Yui  <naruse@ruby-lang.org>
+
+	* string.c (rb_str_casemap): int is too small for string size.
+
 Tue Jun 21 15:42:22 2016  Martin Duerst  <duerst@it.aoyama.ac.jp>
 
 	* test/ruby/test_in.rb: Skip test_read_buffer_error on cygwin,
diff --git a/string.c b/string.c
index 73e742696a..93d247f57e 100644
--- a/string.c
+++ b/string.c
@@ -5773,7 +5773,7 @@ rb_str_casemap(VALUE source, OnigCaseFoldType *flags, rb_encoding *enc)
     int target_length = 0;
     mapping_buffer pre_buffer, /* only next pointer used */
 		  *current_buffer = &pre_buffer;
-    int buffer_count = 0;
+    size_t buffer_count = 0;
     int buffer_length_or_invalid;
 
     if (RSTRING_LEN(source) == 0) return rb_str_dup(source);
@@ -5783,7 +5783,7 @@ rb_str_casemap(VALUE source, OnigCaseFoldType *flags, rb_encoding *enc)
 
     while (source_current < source_end) {
 	/* increase multiplier using buffer count to converge quickly */
-	int capa = (int)(source_end-source_current)*++buffer_count + CASE_MAPPING_ADDITIONAL_LENGTH;
+	size_t capa = (size_t)(source_end-source_current)*++buffer_count + CASE_MAPPING_ADDITIONAL_LENGTH;
 /* fprintf(stderr, "Buffer allocation, capa is %d\n", capa); *//* for tuning */
 	current_buffer->next = (mapping_buffer*)ALLOC_N(char, sizeof(mapping_buffer)+capa);
 	current_buffer = current_buffer->next;