Skip to content

Fix overflow parsing large float exponents#20

Merged
tjol merged 1 commit intotjol:mainfrom
skeeto:fix-signed-overflow
Mar 6, 2026
Merged

Fix overflow parsing large float exponents#20
tjol merged 1 commit intotjol:mainfrom
skeeto:fix-signed-overflow

Conversation

@skeeto
Copy link
Copy Markdown
Contributor

@skeeto skeeto commented Feb 12, 2026

Parsing huge exponents results in a signed overflow (UB). In practice it likely wraps to an incorrect KDL number for the input. The fix includes a test that fails without it.


To demonstrate the bug two ways at once:

$ CFLAGS=-fsanitize=undefined cmake -B build
$ cmake --build build
$ echo 'x 0e10000000000' | build/src/utils/ckdl-cat 
src/parser.c:1051:55: runtime error: signed integer overflow: 1000000000 * 10 cannot be represented in type 'int'
x 1.0

First, UBSan detects signed overflow, then an incorrect result of 1.0 due to wrapping.

Parsing huge exponents results in a signed overflow (UB). In practice it
likely wraps to an incorrect KDL number for the input. The fix includes
a test that fails without it.
@tjol
Copy link
Copy Markdown
Owner

tjol commented Mar 6, 2026

Ok, wow. It took me a moment to understand what the actual issue was. Beautiful and astonishing UBsan find!

@tjol tjol merged commit c9c33fe into tjol:main Mar 6, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants