Skip to content

Signed overflow in zz_divremi #18

@percontation

Description

@percontation

In the line r += b; in zz_divremi (zz.c:475), r and b can have large values that cause signed overflow.

For example, I believe running the t-zz test triggers a call where r == -4156049824137537374 and b == -7351016435385864854. (As noticed by ubsan, as I was trying to test unrelated functions I was adding.)

This is definitely a theoretical issue because signed overflow is undefined behavior in C, but have not attempted to determine if it's actually an issue that causes zz_divremi to have wrong values. (And, if there are no wrong values, an appropriate fix is just to cast things around for that addition.)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions