admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

mruby-bigint: fix null pointer dereference in xor fast path

Browse Source 
when xoring bigint with small integer, the fast path assumes source
bigint has allocated limbs. malformed bigints with sn > 0 but sz == 0
caused null pointer access. add defensive check to allocate storage
before accessing c.p[0].

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2025-10-13 09:09:47 +09:00
parent f4d6e67656
commit 003bdf5031
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-bigint/core/bigint.c
+7 -1
View File
@@ -3457,7 +3457,13 @@ mrb_bint_xor(mrb_state *mrb, mrb_value x, mrb_value y)
if (z == 0) return x;
if (0 < z && (mp_dbl_limb)z < DIG_BASE) {
mpz_init_set(ctx, &c, &a);
c.p[0] ^= z;
if (a.sz == 0) {
mpz_realloc(ctx, &c, 1);
c.p[0] = z;
}
else {
c.p[0] ^= z;
}
return bint_norm(mrb, bint_new(ctx, &c));
}
}