admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

mruby-bigint: fix OOM by limiting left shift size in mpz_mul_2exp

Browse Source 
Add MRB_BIGINT_BIT_LIMIT (1 billion bits / 128MB) to prevent
unreasonably large allocations when left-shifting by huge amounts.
Raises RangeError instead of attempting multi-GB allocations.

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2026-01-09 08:32:52 +09:00
parent 1768b0c6eb
commit 0a5ec60e5c
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-bigint/core/bigint.c
+9
View File
@@ -2071,6 +2071,9 @@ mpz_get_int(mpz_t *y, mrb_int *v)
return TRUE;
}
/* Maximum bits for bigint operations (128MB of limb data) */
#define MRB_BIGINT_BIT_LIMIT (128 * 1024 * 1024 * (size_t)8)
static void
mpz_mul_2exp(mpz_ctx_t *ctx, mpz_t *z, mpz_t *x, mrb_int e)
{
@@ -2082,6 +2085,12 @@ mpz_mul_2exp(mpz_ctx_t *ctx, mpz_t *z, mpz_t *x, mrb_int e)
size_t bs = e % DIG_SIZE;
mpz_t y;
/* Check for result size overflow before allocation */
size_t result_bits = (size_t)x->sz * DIG_SIZE + (size_t)e;
if ((size_t)e > MRB_BIGINT_BIT_LIMIT || result_bits > MRB_BIGINT_BIT_LIMIT) {
mrb_state *mrb = MPZ_MRB(ctx);
mrb_raise(mrb, E_RANGE_ERROR, "shift width too large");
}
mpz_init_heap(ctx, &y, x->sz+digs);
for (size_t i=0;i<x->sz;i++)
y.p[i+digs] = x->p[i];