From b479f974588aac952dfab92ef36e4e12e851c53a Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Tue, 13 Jan 2026 00:24:24 +0900 Subject: [PATCH] mruby-bigint: fix heap-buffer-overflow in bitwise OR/XOR early returns When mpz_or or mpz_xor copies an operand when the other is zero, the copied mpz_t may have an inflated sz field (larger than actual allocated limbs). Add trim() after mpz_set to normalize the size. This is a follow-up fix to commit 61aa2234d8 which addressed the same issue in shift operations. Co-authored-by: Claude --- mrbgems/mruby-bigint/core/bigint.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mrbgems/mruby-bigint/core/bigint.c b/mrbgems/mruby-bigint/core/bigint.c index 894f75ac2..c48fb063e 100644 --- a/mrbgems/mruby-bigint/core/bigint.c +++ b/mrbgems/mruby-bigint/core/bigint.c @@ -3000,11 +3000,13 @@ mpz_or(mpz_ctx_t *ctx, mpz_t *z, mpz_t *x, mpz_t *y) /* not the most efficient if (zero_p(x)) { mpz_init_heap(ctx, z, y->sz); mpz_set(ctx, z, y); + trim(z); return; } if (zero_p(y)) { mpz_init_heap(ctx, z, x->sz); mpz_set(ctx, z, x); + trim(z); return; } mrb_assert(x->sz > 0 || y->sz > 0); @@ -3034,11 +3036,13 @@ mpz_xor(mpz_ctx_t *ctx, mpz_t *z, mpz_t *x, mpz_t *y) /* not the most efficient if (zero_p(x)) { mpz_init_heap(ctx, z, y->sz); mpz_set(ctx, z, y); + trim(z); return; } if (zero_p(y)) { mpz_init_heap(ctx, z, x->sz); mpz_set(ctx, z, x); + trim(z); return; } mrb_assert(x->sz > 0 || y->sz > 0);