From 9133124bef971297581ae225add268a36c983e6b Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Sat, 15 Nov 2025 12:11:31 +0900 Subject: [PATCH] mruby-bigint: add safety margin to karatsuba scratch allocation prevents buffer overrun in karatsuba multiplication scratch space due to rounding errors in recursive partitioning. empirically determined 8-limb margin fixes valgrind-detected overrun with large exponentiations. Co-authored-by: Claude --- mrbgems/mruby-bigint/core/bigint.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mrbgems/mruby-bigint/core/bigint.c b/mrbgems/mruby-bigint/core/bigint.c index e447e0cb0..11210bc19 100644 --- a/mrbgems/mruby-bigint/core/bigint.c +++ b/mrbgems/mruby-bigint/core/bigint.c @@ -1104,6 +1104,8 @@ mpz_mul(mpz_ctx_t *ctx, mpz_t *ww, mpz_t *u, mpz_t *v) mpz_realloc(ctx, ww, result_size); size_t scratch_size = karatsuba_scratch_size(u->sz, v->sz); + /* Add safety margin to account for rounding in recursive partitioning */ + scratch_size += 8; size_t pool_state = pool_save(ctx); mp_limb *scratch = NULL;