From 74c07693193a856b21b5eb821b7a6eb3b6cf6bd6 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Sat, 15 Nov 2025 22:19:17 +0900 Subject: [PATCH] mruby-bigint: fix memory leak in mpz_mod() when reusing initialized mpz_t mpz_mod() was calling mpz_init_heap() on its output parameter, assuming it was uninitialized. However, callers like mpz_powm_i() pass already- initialized variables, causing the old allocations to leak. Changed to use mpz_realloc() which properly handles both cases. Co-authored-by: Claude --- mrbgems/mruby-bigint/core/bigint.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/mrbgems/mruby-bigint/core/bigint.c b/mrbgems/mruby-bigint/core/bigint.c index 11210bc19..b3e49a27b 100644 --- a/mrbgems/mruby-bigint/core/bigint.c +++ b/mrbgems/mruby-bigint/core/bigint.c @@ -1644,7 +1644,6 @@ mpz_mod(mpz_ctx_t *ctx, mpz_t *r, mpz_t *x, mpz_t *y) short sn = x->sn; if (zero_p(x)) { - mpz_init(ctx, r); zero(r); return; } @@ -1661,7 +1660,7 @@ mpz_mod(mpz_ctx_t *ctx, mpz_t *r, mpz_t *x, mpz_t *y) mpz_t mu; mpz_init_temp(ctx, &mu, y->sz + 1); mpz_barrett_mu(ctx, &mu, y); - mpz_init_heap(ctx, r, y->sz); + mpz_realloc(ctx, r, y->sz); mpz_barrett_reduce(ctx, r, x, y, &mu); r->sn = sn; if (uzero_p(r)) @@ -1673,7 +1672,7 @@ mpz_mod(mpz_ctx_t *ctx, mpz_t *r, mpz_t *x, mpz_t *y) /* General division fallback */ mpz_t q; mpz_init_temp(ctx, &q, x->sz); - mpz_init_heap(ctx, r, y->sz); + mpz_realloc(ctx, r, y->sz); udiv(ctx, &q, r, x, y); r->sn = sn; if (uzero_p(r))