Skip to content

Commit 6f70d59

Browse files
committed
Sanitizer fix: signed integer overflow
lib/infer.cpp:131:39: runtime error: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long long int' lib/infer.cpp:141:39: runtime error: signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long long int' lib/infer.cpp:322:65: runtime error: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long long int'
1 parent 3410738 commit 6f70d59

1 file changed

Lines changed: 20 additions & 6 deletions

File tree

lib/infer.cpp

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -127,8 +127,12 @@ namespace {
127127
Interval result;
128128
const ValueFlow::Value* minValue = getCompareValue(values, predicate, std::less<MathLib::bigint>{});
129129
if (minValue) {
130-
if (minValue->isImpossible() && minValue->bound == ValueFlow::Value::Bound::Upper)
131-
result.setMinValue(minValue->intvalue + 1, minValue);
130+
if (minValue->isImpossible() && minValue->bound == ValueFlow::Value::Bound::Upper) {
131+
if (std::numeric_limits<long long>::max() == minValue->intvalue)
132+
result.setMinValue(minValue->intvalue, minValue);
133+
else
134+
result.setMinValue(minValue->intvalue + 1, minValue);
135+
}
132136
if (minValue->isPossible() && minValue->bound == ValueFlow::Value::Bound::Lower)
133137
result.setMinValue(minValue->intvalue, minValue);
134138
if (!minValue->isImpossible() && (minValue->bound == ValueFlow::Value::Bound::Point || minValue->isKnown()) &&
@@ -137,8 +141,12 @@ namespace {
137141
}
138142
const ValueFlow::Value* maxValue = getCompareValue(values, predicate, std::greater<MathLib::bigint>{});
139143
if (maxValue) {
140-
if (maxValue->isImpossible() && maxValue->bound == ValueFlow::Value::Bound::Lower)
141-
result.setMaxValue(maxValue->intvalue - 1, maxValue);
144+
if (maxValue->isImpossible() && maxValue->bound == ValueFlow::Value::Bound::Lower) {
145+
if (std::numeric_limits<long long>::min() == maxValue->intvalue)
146+
result.setMaxValue(minValue->intvalue, maxValue);
147+
else
148+
result.setMaxValue(maxValue->intvalue - 1, maxValue);
149+
}
142150
if (maxValue->isPossible() && maxValue->bound == ValueFlow::Value::Bound::Upper)
143151
result.setMaxValue(maxValue->intvalue, maxValue);
144152
assert(!maxValue->isKnown());
@@ -312,14 +320,20 @@ std::vector<ValueFlow::Value> infer(const ValuePtr<InferModel>& model,
312320
result.push_back(std::move(value));
313321
} else {
314322
if (!diff.minvalue.empty()) {
315-
ValueFlow::Value value(diff.minvalue.front() - 1);
323+
int adder(0);
324+
if (std::numeric_limits<long long>::min() < diff.minvalue.front())
325+
adder = -1;
326+
ValueFlow::Value value(diff.minvalue.front() + adder);
316327
value.setImpossible();
317328
value.bound = ValueFlow::Value::Bound::Upper;
318329
addToErrorPath(value, diff.minRef);
319330
result.push_back(std::move(value));
320331
}
321332
if (!diff.maxvalue.empty()) {
322-
ValueFlow::Value value(diff.maxvalue.front() + 1);
333+
int adder(0);
334+
if (std::numeric_limits<long long>::max() > diff.maxvalue.front())
335+
adder = 1;
336+
ValueFlow::Value value(diff.maxvalue.front() + adder);
323337
value.setImpossible();
324338
value.bound = ValueFlow::Value::Bound::Lower;
325339
addToErrorPath(value, diff.maxRef);

0 commit comments

Comments
 (0)