Yukihiro "Matz" Matsumoto 54fbf6c3ec bigint.c: fix buffer overflow in mpz_div_2exp with large shift ...

When right-shifting by more bits than the number contains, the loop
condition `i < x->sz - digs` would underflow (since size_t is unsigned),
causing out-of-bounds memory access.

Fixed by checking if digs >= x->sz upfront and returning zero in that
case, since shifting right by more bits than the number has always
yields zero.

Discovered via ClusterFuzz with input "7<<78<<-772".

Co-authored-by: Claude <noreply@anthropic.com>

2025-12-30 14:46:26 +09:00

..

bigint.c

bigint.c: fix buffer overflow in mpz_div_2exp with large shift

2025-12-30 14:46:26 +09:00

bigint.h

misc: fix spelling

2025-05-14 02:01:02 +10:00