From 003bdf5031713364fe98f65d0de8e58bd7b74329 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Mon, 13 Oct 2025 09:09:47 +0900 Subject: [PATCH] mruby-bigint: fix null pointer dereference in xor fast path when xoring bigint with small integer, the fast path assumes source bigint has allocated limbs. malformed bigints with sn > 0 but sz == 0 caused null pointer access. add defensive check to allocate storage before accessing c.p[0]. Co-authored-by: Claude --- mrbgems/mruby-bigint/core/bigint.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/mrbgems/mruby-bigint/core/bigint.c b/mrbgems/mruby-bigint/core/bigint.c index 6d80bca7e..abb5d901f 100644 --- a/mrbgems/mruby-bigint/core/bigint.c +++ b/mrbgems/mruby-bigint/core/bigint.c @@ -3457,7 +3457,13 @@ mrb_bint_xor(mrb_state *mrb, mrb_value x, mrb_value y) if (z == 0) return x; if (0 < z && (mp_dbl_limb)z < DIG_BASE) { mpz_init_set(ctx, &c, &a); - c.p[0] ^= z; + if (a.sz == 0) { + mpz_realloc(ctx, &c, 1); + c.p[0] = z; + } + else { + c.p[0] ^= z; + } return bint_norm(mrb, bint_new(ctx, &c)); } }