[PATCH] D144661: Avoid unintended integer overflow in bitstream handling

[Andy Kaylor via Phabricator via llvm-commits]

andrew.w.kaylor created this revision.
andrew.w.kaylor added a reviewer: tahonermann.
Herald added a project: All.
andrew.w.kaylor requested review of this revision.
Herald added a project: LLVM.
Herald added a subscriber: llvm-commits.

This change fixes two cases detected by static analysis where an operation is being performed on a 32-bit integer which may overflow and the result is assigned to a 64-bit integer.


https://reviews.llvm.org/D144661

Files:
  llvm/include/llvm/Bitstream/BitstreamReader.h
  llvm/include/llvm/Bitstream/BitstreamWriter.h


Index: llvm/include/llvm/Bitstream/BitstreamWriter.h
===================================================================
--- llvm/include/llvm/Bitstream/BitstreamWriter.h
+++ llvm/include/llvm/Bitstream/BitstreamWriter.h
@@ -111,7 +111,7 @@
   /// valid. Flushing only occurs at (sub)block boundaries.
   BitstreamWriter(SmallVectorImpl<char> &O, raw_fd_stream *FS = nullptr,
                   uint32_t FlushThreshold = 512)
-      : Out(O), FS(FS), FlushThreshold(FlushThreshold << 20), CurBit(0),
+      : Out(O), FS(FS), FlushThreshold(uint64_t(FlushThreshold) << 20), CurBit(0),
         CurValue(0), CurCodeSize(2) {}
 
   ~BitstreamWriter() {
Index: llvm/include/llvm/Bitstream/BitstreamReader.h
===================================================================
--- llvm/include/llvm/Bitstream/BitstreamReader.h
+++ llvm/include/llvm/Bitstream/BitstreamReader.h
@@ -115,7 +115,7 @@
 
   /// Return the bit # of the bit we are reading.
   uint64_t GetCurrentBitNo() const {
-    return NextChar*CHAR_BIT - BitsInCurWord;
+    return uint64_t(NextChar)*CHAR_BIT - BitsInCurWord;
   }
 
   // Return the byte # of the current bit.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D144661.499925.patch
Type: text/x-patch
Size: 1137 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20230223/a6aa069a/attachment.bin>