mruby-bigint: fix heap-buffer-overflow from inflated sz in mpz_set copies

Add trim() after mpz_set in early return paths to prevent propagation
of inflated sz values. When an mpz_t has sz larger than actual allocated
limbs, copying it without trim causes subsequent operations to read
beyond allocated memory.

Fixed functions:
- mpz_add: when one operand is zero
- mpz_neg: when copying operand
- mpz_mod_2exp: when x < 2^e

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2026-01-14 00:58:40 +09:00
parent d9a7d1a6b0
commit b4af2afd31
+4
View File
@@ -450,10 +450,12 @@ mpz_add(mpz_ctx_t *ctx, mpz_t *zz, mpz_t *x, mpz_t *y)
{
if (zero_p(x)) {
mpz_set(ctx, zz, y);
trim(zz);
return;
}
if (zero_p(y)) {
mpz_set(ctx, zz, x);
trim(zz);
return;
}
@@ -3058,6 +3060,7 @@ mpz_neg(mpz_ctx_t *ctx, mpz_t *x, mpz_t *y)
{
mpz_init_heap(ctx, x, y->sz);
mpz_set(ctx, x, y);
trim(x);
x->sn = -(y->sn);
}
@@ -3082,6 +3085,7 @@ mpz_mod_2exp(mpz_ctx_t *ctx, mpz_t *z, mpz_t *x, mrb_int e)
mpz_clear(ctx, z);
mpz_init_heap(ctx, z, x->sz);
mpz_set(ctx, z, x);
trim(z);
}
return;
}