Fix: overflow of signed integer results in undefined behaviour

The expression "min_value = -((int64_t)1 << (size - 1))"

will result in a signed integer overflow when size is 64
((1ULL << 63) > LONG_MAX).

Note that larger sizes are unsupported and checked for in the setter.

Signed overflows result in undefined behaviour and llvm takes
advantage of this to optimize away the range check

"if (value < min_value || value > max_value) {"

Surprisingly, this was not catched by GCC, Coverity, scan-build or
cppcheck.

The fix consists in computing both bounds using an unsigned long long
type and, in the case of the lower bound, negating it (resulting in a
long long).

Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>

diff --git a/formats/ctf/writer/event-fields.c b/formats/ctf/writer/event-fields.c
index c49bc3fa6dc1bca5b325b1be872480c9e68a1487..1ffbd4a350b53741b00523f4f392fbc2934872c7 100644 (file)
--- a/formats/ctf/writer/event-fields.c
+++ b/formats/ctf/writer/event-fields.c
@@ -524,8 +524,8 @@ int bt_ctf_field_signed_integer_set_value(struct bt_ctf_field *field,
        }
 
        size = integer_type->declaration.len;
-       min_value = -((int64_t)1 << (size - 1));
-       max_value = ((int64_t)1 << (size - 1)) - 1;
+       min_value = -(1ULL << (size - 1));
+       max_value = (1ULL << (size - 1)) - 1;
        if (value < min_value || value > max_value) {
                ret = -1;
                goto end;