beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-09-30 00:31:14 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

LibJS: Avoid undefined static cast of negative values in to_u32

Browse source 
If the value we get after fmod in Value::to_u32 is negative, UBSAN
complains that -N is out of bounds for u32. An extra static cast to i64
makes it stop complaining. An alternative implementation could add 2^32
if the fmod'd value is negative. Caught by UBSAN and oss-fuzz.
This commit is contained in:
Andrew Kaster 2021-05-31 13:05:39 -06:00 committed by Andreas Kling
parent 091628202f
commit 1f2720ce0d
Notes: sideshowbarker 2024-07-18 11:26:22 +09:00 
Author: https://github.com/ADKaster
Commit: https://github.com/SerenityOS/serenity/commit/1f2720ce0d4
Pull-request: https://github.com/SerenityOS/serenity/pull/7643
Reviewed-by: https://github.com/awesomekling
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Userland/Libraries/LibJS/Runtime/Value.cpp
View file

@ -637,7 +637,9 @@ u32 Value::to_u32(GlobalObject& global_object) const
if (signbit(value))
int_val = -int_val;
auto int32bit = fmod(int_val, NumericLimits<u32>::max() + 1.0);
return static_cast<u32>(int32bit);
// Cast to i64 here to ensure that the double --> u32 cast doesn't invoke undefined behavior
// Otherwise, negative numbers cause a UBSAN warning.
return static_cast<u32>(static_cast<i64>(int32bit));
}
// 7.1.8 ToInt16 ( argument ), https://tc39.es/ecma262/#sec-toint16