From b84bca666fdc4fe94286b49b6f6b9a64e4c3a534 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Tue, 19 Jul 2022 18:20:28 +0900 Subject: [PATCH] bigint.c (mpz_get_int): avoid buffer overflow. --- mrbgems/mruby-bigint/core/bigint.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/mrbgems/mruby-bigint/core/bigint.c b/mrbgems/mruby-bigint/core/bigint.c index 21d1008e3..5d91c0673 100644 --- a/mrbgems/mruby-bigint/core/bigint.c +++ b/mrbgems/mruby-bigint/core/bigint.c @@ -742,17 +742,21 @@ static int mpz_get_int(mpz_t *y, mrb_int *v) { mp_limb i; + size_t d; if (y->sn == 0) { i = 0; } - else if (digits(y) > 2 || y->p[1] > 1) { + else if ((d = digits(y)) > 2 || (d == 2 && y->p[1] > 1)) { return FALSE; } - else { + else if (d == 2) { i = (y->sn * (y->p[0] | (y->p[1] & 1) << DIGITBITS)); - if (MRB_INT_MAX < i || i < MRB_INT_MIN) return FALSE; } + else {/* d == 1 */ + i = y->sn * y->p[0]; + } + if (MRB_INT_MAX < i || i < MRB_INT_MIN) return FALSE; *v = i; return TRUE; }