[BUG/PATCH] GMP 6.3.0 Mini-GMP: allocation metadata overflow above INT_MAX limbs

[Nad Ka]

Hello,

I found a reproducible allocation-metadata range issue in GNU GMP 6.3.0
Mini-GMP and prepared a minimal patch with validation evidence.

Affected file:
mini-gmp/mini-gmp.c

Problem:
Mini-GMP computes requested allocation sizes in mp_size_t, but stores
_mp_alloc in int. On the tested LP64 systems, INT_MAX+1 limbs is
representable in mp_size_t but narrows _mp_alloc to INT_MIN. The issue is
reproducible through mpz_init2, mpz_realloc2, and mpz_limbs_modify. A later
free callback can then receive an incorrect size derived from the corrupted
allocation metadata.

Observed at INT_MAX+1 limbs on the original source:
REQUESTED_LIMBS=2147483648
STORED__mp_alloc=-2147483648
METADATA_MATCH=NO

Proposed patch:
Reject sizes greater than INT_MAX before writing allocation metadata in
both the direct mpz_init2 allocation path and the shared mpz_realloc path.

Validation:

   - AArch64 targeted boundary matrix, GCC and Clang: PASS
   - AArch64 upstream Mini-GMP suite, original/patched GCC: PASS
   - AArch64 upstream Mini-GMP suite, original/patched Clang: PASS
   - AArch64 non-regression comparison: PASS
   - x86_64 targeted INT_MAX / INT_MAX+1 matrix, GCC and Clang: PASS
   - x86_64 full Mini-GMP suite: not yet run in this evidence package; no
   broader claim is made

Finding commit:
22d004b059574779da2d321918d2767a6a6f5c36

Public finding:
https://github.com/frenchcryptonad-max/linux-arm64-build-findings/tree/main/findings/gmp-6.3.0/mini-gmp-mpz-init2-int-overflow

Source hashes used for validation:
mini-gmp.c 378a9731eb6fd69b93fa074172f79be4089c813365613e414f4da4923dcbda52
mini-gmp.h 54ec9383fdf6103a0e22bde2663ca8eb420338015839b663e0eccee103afae99

Licensing:
The patch contribution is offered under the same recipient-choice terms as
GNU GMP mini-gmp.c: GNU LGPL version 3 or later, or GNU GPL version 2 or
later. OSARM-authored evidence/report material in the package is offered
under Apache-2.0; upstream-derived patch context retains GMP’s upstream
license.

The attached archive contains the patch, sanitized evidence, license
notice, license texts, source hashes and SHA-256 manifests. Privacy scan
and SHA-256 verification passed before sending.

Regards,
FrenchCryptoNad
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gmp-mini-gmp-upstream-submission.tar.gz
Type: application/octet-stream
Size: 16203 bytes
Desc: not available
URL: <https://gmplib.org/list-archives/gmp-bugs/attachments/20260905/87b8fd48/attachment-0002.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gmp-mini-gmp-upstream-submission.tar.gz.sha256
Type: application/octet-stream
Size: 106 bytes
Desc: not available
URL: <https://gmplib.org/list-archives/gmp-bugs/attachments/20260905/87b8fd48/attachment-0003.obj>