From bec8b53031077b93c42cd543ba41beeffaf8f8c3 Mon Sep 17 00:00:00 2001 From: Taylor R Campbell Date: Mon, 17 Jun 2024 15:12:38 +0000 Subject: [PATCH] libc ldexp(3): Avoid undefined behaviour in arithmetic overflow. PR lib/NNNNN --- lib/libc/compat/gen/compat_ldexp_ieee754.c | 26 +++++++++++++++++----- 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/lib/libc/compat/gen/compat_ldexp_ieee754.c b/lib/libc/compat/gen/compat_ldexp_ieee754.c index 8c8cb49a935c..f507a8cdd280 100644 --- a/lib/libc/compat/gen/compat_ldexp_ieee754.c +++ b/lib/libc/compat/gen/compat_ldexp_ieee754.c @@ -115,17 +115,31 @@ ldexp(double val, int expon) /* * u.v is now normalized and oldexp has been adjusted if necessary. - * Calculate the new exponent and check for underflow and overflow. + * We have + * + * 0 <= oldexp <= DBL_EXP_INFNAN, + * + * but + * + * INT_MIN <= expon <= INT_MAX. + * + * Check for underflow and overflow, and if none, calculate the + * new exponent. */ - newexp = oldexp + expon; - - if (newexp >= DBL_EXP_INFNAN || - (oldexp >= 0 && expon >= DBL_EXP_INFNAN)) { + if (expon >= DBL_EXP_INFNAN - oldexp) { /* * The result overflowed; return +/-Inf. */ return overflow(val); - } else if (newexp <= 0) { + } + + /* + * We now have INT_MIN <= oldexp + expon <= DBL_EXP_INFNAN <= INT_MAX, + * so the arithmetic is safe. + */ + newexp = oldexp + expon; + + if (newexp <= 0) { /* * The output number is either denormal or underflows (see * comments in machine/ieee.h).