admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

bigint.c: fix memory leak in mpz_div_2exp

Browse Source 
mpz_div_2exp() was calling mpz_init_heap() on output parameter z
without first freeing z's existing memory. When called from
mpz_barrett_reduce() with pre-allocated temporaries, this caused
memory leaks.

Add mpz_clear(ctx, z) before mpz_init_heap() in both affected code
paths, matching the pattern already used in mpz_mod_2exp().

Fixes ClusterFuzz issue detected with input "8.pow 7*2515881+186,8 ^4>>-509".

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2025-12-30 18:20:41 +09:00
parent dcd4fe9fb0
commit 53ee1a7826
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-bigint/core/bigint.c
+2
View File
@@ -2091,6 +2091,7 @@ mpz_div_2exp(mpz_ctx_t *ctx, mpz_t *z, mpz_t *x, mrb_int e)
short sn = x->sn;
if (e == 0) {
if (z != x) {
mpz_clear(ctx, z);
mpz_init_heap(ctx, z, x->sz);
mpz_set(ctx, z, x);
}
@@ -2113,6 +2114,7 @@ mpz_div_2exp(mpz_ctx_t *ctx, mpz_t *z, mpz_t *x, mrb_int e)
for (size_t i = 0; i < new_size; i++)
y.p[i] = x->p[i + digs];
if (bs) {
mpz_clear(ctx, z);
mpz_init_heap(ctx, z, new_size);
urshift(ctx, z, &y, bs);
mpz_clear(ctx, &y);