admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Address stack-use-after-return in the mruby bigint implementation.

Browse Source 
The fix is to modify `bint_set` to ensure that the data stored in the persistent `RBigint` object is allocated on the heap if it's not embedded. We check if the source `mpz_t` uses memory from the stack pool using `is_pool_memory`. If it does, we must perform a deep copy (`mpz_set`) to allocate new heap memory and copy the data, instead of moving the pointer (`mpz_move`). If the source is already on the heap, we retain the efficient `mpz_move`.


OSS-Fuzz testcase: https://oss-fuzz.com/testcase-detail/5279371075321856
This commit is contained in:
Meder Kydyraliev
2025-10-23 16:23:52 +11:00
committed by GitHub
parent 93619f06dd
commit 49bc07d9a1
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-bigint/core/bigint.c
+11 -2
View File
@@ -2767,8 +2767,17 @@ bint_set(mpz_ctx_t *ctx, struct RBigint *b, mpz_t *x)
}
else {
RBIGINT_SET_HEAP(b);
mpz_move(ctx, &b->as.heap, x);
}
#if MRB_BIGINT_POOL_SIZE > 0
if (MPZ_HAS_POOL(ctx) && is_pool_memory(x, MPZ_POOL(ctx))) {
/* mpz_move() cannot be used because x is in the pool. */
mpz_set(ctx, &b->as.heap, x);
mpz_clear(ctx, x);
}
else
#endif
{
mpz_move(ctx, &b->as.heap, x);
}
}
static struct RBigint*