trafficserver icon indicating copy to clipboard operation
trafficserver copied to clipboard

CID 1508885: Unintentional integer overflow

Open maskit opened this issue 2 years ago • 1 comments

Histogram.h

167template <auto R, auto S>
168auto
169Histogram<R, S>::min_for_bucket(unsigned idx) -> raw_type
170{
171  auto range         = idx / N_SPAN_BUCKETS;
172  raw_type base      = 0; // minimum value for the range (not span!).
173  raw_type span_size = 1; // for @a range 0 or 1
174  if (range > 0) {
   	
CID 1508885 (#1 of 1): Unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)
overflow_before_widen: Potentially overflowing expression 1 << range + 2UL - 1UL with type int (32 bits, signed) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type ts::Histogram<7, 2>::raw_type (64 bits, unsigned).
   	To avoid overflow, cast 1 to type ts::Histogram<7, 2>::raw_type.
175    base = 1 << (range + N_SPAN_BITS - 1);
176    if (range > 1) { // at @a range == 1 this would be 0, which is wrong.
177      span_size = base >> N_SPAN_BITS;
178    }
179  }
180  return base + span_size * (idx & SPAN_MASK);
181}

maskit avatar Sep 14 '23 17:09 maskit

This issue has been automatically marked as stale because it has not had recent activity. Marking it stale to flag it for further consideration by the community.

github-actions[bot] avatar Sep 14 '24 01:09 github-actions[bot]