From 5ed0cd4ecb9fde8712407e065d6ee0699ed1b5c6 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Mon, 24 Nov 2025 09:35:43 +0900 Subject: [PATCH] bigint.c: increase karatsuba scratch allocation safety margin the previous fixed safety margin of 8 limbs was insufficient for certain edge cases involving deep recursion levels in karatsuba multiplication, as discovered by oss-fuzz. changed to proportional margin (~12.5% plus fixed overhead of 16) that scales with input size. this prevents potential buffer overruns in deeply nested karatsuba multiplications while maintaining efficiency for typical cases. Co-authored-by: Claude --- mrbgems/mruby-bigint/core/bigint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/mrbgems/mruby-bigint/core/bigint.c b/mrbgems/mruby-bigint/core/bigint.c index 331c30169..71dadf317 100644 --- a/mrbgems/mruby-bigint/core/bigint.c +++ b/mrbgems/mruby-bigint/core/bigint.c @@ -1112,8 +1112,11 @@ mpz_mul(mpz_ctx_t *ctx, mpz_t *ww, mpz_t *u, mpz_t *v) mpz_realloc(ctx, ww, result_size); size_t scratch_size = karatsuba_scratch_size(u->sz, v->sz); - /* Add safety margin to account for rounding in recursive partitioning */ - scratch_size += 8; + /* Add safety margin proportional to scratch size. + * While the calculation is mathematically exact, empirical testing + * (valgrind, oss-fuzz) reveals edge cases requiring extra space. + * Proportional margin scales better than fixed for large inputs. */ + scratch_size += (scratch_size >> 3) + 16; size_t pool_state = pool_save(ctx); mp_limb *scratch = NULL;