From b4af2afd319c3d3324ed99832ad337e2020827ea Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Wed, 14 Jan 2026 00:58:40 +0900 Subject: [PATCH] mruby-bigint: fix heap-buffer-overflow from inflated sz in mpz_set copies Add trim() after mpz_set in early return paths to prevent propagation of inflated sz values. When an mpz_t has sz larger than actual allocated limbs, copying it without trim causes subsequent operations to read beyond allocated memory. Fixed functions: - mpz_add: when one operand is zero - mpz_neg: when copying operand - mpz_mod_2exp: when x < 2^e Co-authored-by: Claude --- mrbgems/mruby-bigint/core/bigint.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mrbgems/mruby-bigint/core/bigint.c b/mrbgems/mruby-bigint/core/bigint.c index 2c634c9b5..6073052b7 100644 --- a/mrbgems/mruby-bigint/core/bigint.c +++ b/mrbgems/mruby-bigint/core/bigint.c @@ -450,10 +450,12 @@ mpz_add(mpz_ctx_t *ctx, mpz_t *zz, mpz_t *x, mpz_t *y) { if (zero_p(x)) { mpz_set(ctx, zz, y); + trim(zz); return; } if (zero_p(y)) { mpz_set(ctx, zz, x); + trim(zz); return; } @@ -3058,6 +3060,7 @@ mpz_neg(mpz_ctx_t *ctx, mpz_t *x, mpz_t *y) { mpz_init_heap(ctx, x, y->sz); mpz_set(ctx, x, y); + trim(x); x->sn = -(y->sn); } @@ -3082,6 +3085,7 @@ mpz_mod_2exp(mpz_ctx_t *ctx, mpz_t *z, mpz_t *x, mrb_int e) mpz_clear(ctx, z); mpz_init_heap(ctx, z, x->sz); mpz_set(ctx, z, x); + trim(z); } return; }