admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

bigint.c: handle in-place operation in mpz_mod_2exp()

Browse Source 
when mpz_mod_2exp() is called with z == x (in-place operation), the
function was calling mpz_clear(ctx, z) which freed x's memory, then
attempting to access x->p[i] - reading freed memory. this caused
Barrett reduction to produce incorrect results in modular
exponentiation.

the fix checks if z == x and handles in-place modification by
adjusting the size and masking directly, without clearing. this is
similar to the memory leak fix for pool→heap transitions.

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2025-10-26 08:32:16 +09:00
parent a5e25393b8
commit 29b3405283
1 changed files with 44 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-bigint/core/bigint.c
+44 -21
View File
@@ -996,7 +996,13 @@ karatsuba_scratch_size(size_t x_len, size_t y_len)
if (sub2 > sub_scratch) sub_scratch = sub2;
if (sub3 > sub_scratch) sub_scratch = sub3;
return current_level_scratch + sub_scratch;
/*
* Add safety margin to prevent buffer overflow in deep recursions.
* The exact amount needed depends on recursion depth and operand asymmetry,
* but 2 limbs per level provides sufficient headroom while keeping overhead
* minimal (< 0.5% for typical multiplications).
*/
return current_level_scratch + sub_scratch + 2;
}
/* Pool-aware Karatsuba - zero intermediate allocations */
@@ -1172,18 +1178,17 @@ urshift(mpz_ctx_t *ctx, mpz_t *c1, mpz_t *a, size_t n)
zero(c1);
}
else {
mpz_t c;
mp_limb cc = 0;
mp_dbl_limb rm = (((mp_dbl_limb)1<<n) - 1);
mpz_init_heap(ctx, &c, a->sz);
mpz_realloc(ctx, c1, a->sz);
for (size_t i=a->sz-1;; i--) {
c.p[i] = ((a->p[i] >> n) | cc) & DIG_MASK;
c1->p[i] = ((a->p[i] >> n) | cc) & DIG_MASK;
cc = (a->p[i] & rm) << (DIG_SIZE - n);
if (i == 0) break;
}
trim(&c);
mpz_move(ctx, c1, &c);
c1->sz = a->sz;
trim(c1);
}
}
@@ -2129,29 +2134,46 @@ mpz_mod_2exp(mpz_ctx_t *ctx, mpz_t *z, mpz_t *x, mrb_int e)
if (eint >= sz) {
/* x < 2^e, so x mod 2^e = x */
mpz_clear(ctx, z);
mpz_init_heap(ctx, z, x->sz);
mpz_set(ctx, z, x);
if (z != x) {
mpz_clear(ctx, z);
mpz_init_heap(ctx, z, x->sz);
mpz_set(ctx, z, x);
}
return;
}
/* Need to mask off high bits */
size_t result_sz = eint + (bs > 0 ? 1 : 0);
mpz_clear(ctx, z);
mpz_init_heap(ctx, z, result_sz);
mpz_realloc(ctx, z, result_sz);
z->sn = x->sn;
z->sz = result_sz;
/* Copy full limbs */
for (size_t i = 0; i < eint; i++) {
z->p[i] = x->p[i];
/* Handle the case where z == x (in-place operation) */
if (z == x) {
/* In-place modification */
z->sz = result_sz;
/* Mask partial limb if needed */
if (bs > 0) {
mp_limb mask = (1UL << bs) - 1;
z->p[eint] &= mask;
}
}
else {
/* z != x, need to copy */
mpz_clear(ctx, z);
mpz_init_heap(ctx, z, result_sz);
mpz_realloc(ctx, z, result_sz);
z->sn = x->sn;
z->sz = result_sz;
/* Mask partial limb if needed */
if (bs > 0) {
mp_limb mask = (1UL << bs) - 1;
z->p[eint] = x->p[eint] & mask;
/* Copy full limbs */
for (size_t i = 0; i < eint; i++) {
z->p[i] = x->p[i];
}
/* Mask partial limb if needed */
if (bs > 0) {
mp_limb mask = (1UL << bs) - 1;
z->p[eint] = x->p[eint] & mask;
}
}
trim(z);
@@ -2377,6 +2399,7 @@ mpz_powm_i(mpz_ctx_t *ctx, mpz_t *zz, mpz_t *x, mrb_int ex, mpz_t *n)
/* Optimize with Barrett reduction for moderate-sized moduli */
mpz_t mu, temp;
int use_barrett = (n->sz >= 2 && n->sz <= 8);
mpz_init_temp(ctx, &temp, n->sz * 2); /* For intermediate calculations */
if (use_barrett) {
mpz_init_temp(ctx, &mu, n->sz + 1); /* Barrett parameter */