[clang] 5e42f09 - [clang][bytecode] Reject non-number values in Rem op (#194309)

[via cfe-commits]

Author: Timm Baeder
Date: 2026-04-27T11:42:13+02:00
New Revision: 5e42f09a6f001ad60ff85bbc0f54290d86033912

URL: https://github.com/llvm/llvm-project/commit/5e42f09a6f001ad60ff85bbc0f54290d86033912
DIFF: https://github.com/llvm/llvm-project/commit/5e42f09a6f001ad60ff85bbc0f54290d86033912.diff

LOG: [clang][bytecode] Reject non-number values in Rem op (#194309)

Added: 
    

Modified: 
    clang/lib/AST/ByteCode/Interp.h
    clang/test/AST/ByteCode/c.c

Removed: 
    


################################################################################
diff  --git a/clang/lib/AST/ByteCode/Interp.h b/clang/lib/AST/ByteCode/Interp.h
index 412a9289e424e..0f1c81fe300e6 100644
--- a/clang/lib/AST/ByteCode/Interp.h
+++ b/clang/lib/AST/ByteCode/Interp.h
@@ -196,6 +196,12 @@ bool CheckShift(InterpState &S, CodePtr OpPC, const LT &LHS, const RT &RHS,
 /// Checks if Div/Rem operation on LHS and RHS is valid.
 template <typename T>
 bool CheckDivRem(InterpState &S, CodePtr OpPC, const T &LHS, const T &RHS) {
+
+  if constexpr (isIntegralOrPointer<T>()) {
+    if (!LHS.isNumber() || !RHS.isNumber())
+      return false;
+  }
+
   if (RHS.isZero()) {
     const auto *Op = cast<BinaryOperator>(S.Current->getExpr(OpPC));
     if constexpr (std::is_same_v<T, Floating>) {

diff  --git a/clang/test/AST/ByteCode/c.c b/clang/test/AST/ByteCode/c.c
index 2e5c003ae3f0f..b1009c0fdf71e 100644
--- a/clang/test/AST/ByteCode/c.c
+++ b/clang/test/AST/ByteCode/c.c
@@ -455,3 +455,6 @@ float r  = (float) (intptr_t) &r; // all-error {{initializer element is not a co
 void labelAndNull(void) { int bar = &*(void *)0 - &&baz; } // all-error {{use of undeclared label 'baz'}} \\
                                                            // pedantic-warning {{use of GNU address-of-label extension}} \
                                                            // pedantic-warning {{arithmetic on pointers to void is a GNU extension}}
+
+void nonNumberRem(void) { *((int *)0) = (long)foo % 42; } // all-warning {{indirection of non-volatile null pointer will be deleted, not trap}} \
+                                                          // all-note {{consider using __builtin_trap() or qualifying pointer with 'volatile'}}