public inbox for binutils@sourceware.org
 help / color / mirror / Atom feed
From: Alan Modra <amodra@gmail.com>
To: binutils@sourceware.org
Cc: Paul Iannetta <piannetta@kalrayinc.com>
Subject: kvx: ubsan: integer overflow
Date: Wed, 23 Aug 2023 11:14:37 +0930	[thread overview]
Message-ID: <ZOVkhY18ZjaQhksv@squeak.grove.modra.org> (raw)

This fixes a few places where ubsan complains about signed integer
overflow when running the testsuite, and that clz(0) is undefined.
When fixing the clz problem, I also noticed that we'd get complaints
if pval is ever LLONG_MIN.  Fix that by using unsigned arithmetic.

	* config/kvx-parse.c (get_token_class): Avoid signed overflow.
	Don't clz(0).
	* config/tc-kvx.c (PARALLEL_BIT): Avoid signed overflow.

diff --git a/gas/config/kvx-parse.c b/gas/config/kvx-parse.c
index ec3f912c476..fe0e2aee737 100644
--- a/gas/config/kvx-parse.c
+++ b/gas/config/kvx-parse.c
@@ -515,9 +515,9 @@ get_token_class (struct token_s *token, struct token_classes *classes, int insn_
 	? token->val
 	: strtoull (tok + (tok[0] == '-') + (tok[0] == '+'), NULL, 0);
       long long val = uval;
-      long long pval = val < 0 ? -val : val;
-      int neg_power2_p = val < 0 && !(pval & (pval - 1));
-      unsigned int len = 8 * sizeof (pval) - __builtin_clzll (pval);
+      long long pval = val < 0 ? -uval : uval;
+      int neg_power2_p = val < 0 && !(uval & (uval - 1));
+      unsigned len = pval ? 8 * sizeof (pval) - __builtin_clzll (pval) : 0;
       for (; class[cur].class_id != -1
 	  && ((unsigned int) (class[cur].sz < 0 ? - class[cur].sz - !neg_power2_p : class[cur].sz) < len
 	      || (exp.X_op == O_symbol && !has_relocation_of_size (str_hash_find (env.reloc_hash, TOKEN_NAME (class[cur].class_id))))
diff --git a/gas/config/tc-kvx.c b/gas/config/tc-kvx.c
index 3cf6b27976d..0e67ead4449 100644
--- a/gas/config/tc-kvx.c
+++ b/gas/config/tc-kvx.c
@@ -49,7 +49,7 @@ static void supported_cores (char buf[], size_t buflen);
 #define STRNEQ(x,y,n) !strncmp(((x) ? (x) : ""), ((y) ? (y) : ""),(n))
 
 /* The PARALLEL_BIT is set to 0 when an instruction is the last of a bundle. */
-#define PARALLEL_BIT (1 << 31)
+#define PARALLEL_BIT (1u << 31)
 
 /*TB begin*/
 int size_type_function = 1;

-- 
Alan Modra
Australia Development Lab, IBM

                 reply	other threads:[~2023-08-23  1:44 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ZOVkhY18ZjaQhksv@squeak.grove.modra.org \
    --to=amodra@gmail.com \
    --cc=binutils@sourceware.org \
    --cc=piannetta@kalrayinc.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).