[clang] [clang][StaticAnalyzer] Fix crash in SimpleSValBuilder with unsigned __int128 and negative literals (PR #150225)
Balazs Benics via cfe-commits
cfe-commits at lists.llvm.org
Fri Jul 25 06:16:46 PDT 2025
================
@@ -250,6 +250,19 @@ BasicValueFactory::evalAPSInt(BinaryOperator::Opcode Op, const llvm::APSInt &V1,
llvm_unreachable("Invalid Opcode.");
case BO_Mul:
+ // For large bit widths (like __int128), check for potential crashes
+ if (V1.getBitWidth() >= 128 || V2.getBitWidth() >= 128) {
+ // If either operand is zero, result is zero
+ if (V1 == 0 || V2 == 0) {
+ return getValue(llvm::APSInt(llvm::APInt::getZero(std::max(V1.getBitWidth(), V2.getBitWidth())),
+ V1.isUnsigned() && V2.isUnsigned()));
+ }
+
+ // For __int128 types, be conservative to avoid crashes in APInt multiplication
+ // This happens when multiplying unsigned __int128 with large values (like negative
+ // numbers converted to unsigned)
+ return std::nullopt;
+ }
----------------
steakhal wrote:
This code does not seem convincing.
In theory, we should be able to evaluate a multiplication here regardless of the bitwidths.
Is there some safe APSInt operation that does this?
And what about the rest of the operations, like `BO_Div` and friends. There we would still crash if I understand this right.
https://github.com/llvm/llvm-project/pull/150225
More information about the cfe-commits
mailing list