admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

mruby-bigint: fix heap-buffer-overflow in bitwise OR/XOR early returns

Browse Source 
When mpz_or or mpz_xor copies an operand when the other is zero,
the copied mpz_t may have an inflated sz field (larger than actual
allocated limbs). Add trim() after mpz_set to normalize the size.

This is a follow-up fix to commit 61aa2234d8 which addressed the
same issue in shift operations.

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2026-01-13 00:24:24 +09:00
parent 97835e5678
commit b479f97458
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-bigint/core/bigint.c
+4
View File
@@ -3000,11 +3000,13 @@ mpz_or(mpz_ctx_t *ctx, mpz_t *z, mpz_t *x, mpz_t *y) /* not the most efficient
if (zero_p(x)) {
mpz_init_heap(ctx, z, y->sz);
mpz_set(ctx, z, y);
trim(z);
return;
}
if (zero_p(y)) {
mpz_init_heap(ctx, z, x->sz);
mpz_set(ctx, z, x);
trim(z);
return;
}
mrb_assert(x->sz > 0 || y->sz > 0);
@@ -3034,11 +3036,13 @@ mpz_xor(mpz_ctx_t *ctx, mpz_t *z, mpz_t *x, mpz_t *y) /* not the most efficient
if (zero_p(x)) {
mpz_init_heap(ctx, z, y->sz);
mpz_set(ctx, z, y);
trim(z);
return;
}
if (zero_p(y)) {
mpz_init_heap(ctx, z, x->sz);
mpz_set(ctx, z, x);
trim(z);
return;
}
mrb_assert(x->sz > 0 || y->sz > 0);