From 9d04c74ed8291d544f4052696c0c4fc03ab59ed6 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Sat, 10 Jan 2026 08:30:18 +0900 Subject: [PATCH] mruby-bigint: fix carry placement in uadd() The final carry was stored at z->p[y->sz], but when x is larger than y, this index falls within the already-computed result and corrupts it. Store at z->p[i] instead, which correctly points to max(x->sz, y->sz) after all loops complete. This bug caused incorrect results when adding a small number to an all-ones number with 1124+ limbs (35968+ bits). Co-authored-by: Claude --- mrbgems/mruby-bigint/core/bigint.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mrbgems/mruby-bigint/core/bigint.c b/mrbgems/mruby-bigint/core/bigint.c index c9cacf9ea..5a2d4df40 100644 --- a/mrbgems/mruby-bigint/core/bigint.c +++ b/mrbgems/mruby-bigint/core/bigint.c @@ -432,8 +432,8 @@ uadd(mpz_t *z, mpz_t *x, mpz_t *y) c >>= DIG_SIZE; } - /* Store final carry */ - z->p[y->sz] = (mp_limb)c; + /* Store final carry at correct position (after all limbs) */ + z->p[i] = (mp_limb)c; } /* z = y - x, ignoring sign */