mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
mruby-bigint: fix heap-buffer-overflow from inflated sz in mpz_set copies
Add trim() after mpz_set in early return paths to prevent propagation of inflated sz values. When an mpz_t has sz larger than actual allocated limbs, copying it without trim causes subsequent operations to read beyond allocated memory. Fixed functions: - mpz_add: when one operand is zero - mpz_neg: when copying operand - mpz_mod_2exp: when x < 2^e Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
@@ -450,10 +450,12 @@ mpz_add(mpz_ctx_t *ctx, mpz_t *zz, mpz_t *x, mpz_t *y)
|
||||
{
|
||||
if (zero_p(x)) {
|
||||
mpz_set(ctx, zz, y);
|
||||
trim(zz);
|
||||
return;
|
||||
}
|
||||
if (zero_p(y)) {
|
||||
mpz_set(ctx, zz, x);
|
||||
trim(zz);
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -3058,6 +3060,7 @@ mpz_neg(mpz_ctx_t *ctx, mpz_t *x, mpz_t *y)
|
||||
{
|
||||
mpz_init_heap(ctx, x, y->sz);
|
||||
mpz_set(ctx, x, y);
|
||||
trim(x);
|
||||
x->sn = -(y->sn);
|
||||
}
|
||||
|
||||
@@ -3082,6 +3085,7 @@ mpz_mod_2exp(mpz_ctx_t *ctx, mpz_t *z, mpz_t *x, mrb_int e)
|
||||
mpz_clear(ctx, z);
|
||||
mpz_init_heap(ctx, z, x->sz);
|
||||
mpz_set(ctx, z, x);
|
||||
trim(z);
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user