UB: (int) cast of a user double outside int range in dispatch / vm_index_is_int / flat_index_at
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Start with the four named sites: builtin_dispatch in src/builtins.c around line 5946, vm_index_is_int in src/vm.c, the list arm of flat_index_at in src/builtins_tensor.c, and finite_num_to_byte. Reproduce with the dispatch snippet from the issue under make asan to see the UBSan float-cast-overflow report. Done when each site range-checks the double before casting (NaN-false), the grep -n '(int)' src/*.c sweep is classified, and the repro prints the value error with no runtime error: line.
Written by the indexing model from the issue text.
Description
Found while building #1746 Phase 1. Several sites convert a user double to int with a bare (int) cast before any range check. For |x| >= 2^31 (today: up to ±1e308; under an IEEE build also inf/NaN) that is undefined behaviour, and UBSan's float-cast-overflow (on in every ASan variant) reports it.
Repro (any asan build):
define g(x) as:
return x
d is dispatch
print of (d of [[g], 1e308, 5])
-> src/builtins.c:5946:20: runtime error: 1e+308 is outside the range of representable values of type 'int' (then the intended dispatch key must be an integer raise).
Sites: builtin_dispatch (builtins.c, (int)eigs_num_arg(key_v, ...)), vm_index_is_int (vm.c), flat_index_at list arm (builtins_tensor.c), finite_num_to_byte ((int)fmod(x,256) with a NaN). The #1746 experiment guards only vm_index_is_int, only under -DEIGS_IEEE.
Done when
- Each listed site range-checks (
!(d >= INT_MIN && d <= INT_MAX)style, NaN-false) before the cast, and the sweepgrep -n '(int)' src/*.cover user-double conversions is classified. - The repro above is clean under
make asan(noruntime error:), and still raisesvalue.
- Dominant language
- C
- Stars
- 3
- Forks
- 7
- Avg merge
- 8h 43m
- Merged PRs (30d)
- 253
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from InauguralSystems/EigenScript
-
area:gates bug good first issue
Difficulty 1/5 Under an hour Newbie friendliness 85/100
InauguralSystems/EigenScript#1782 ·
Maintainers usually reply within 1 day
-
eigenscript.h declares 8 observer functions that no longer existPossibly taken A pull request linked to this issue is open or already merged. Openarea:observer enhancement found-by:cold-read good first issue
Difficulty 1/5 Under an hour Newbie friendliness 88/100
InauguralSystems/EigenScript#1781 ·
Maintainers usually reply within 1 day
-
Amalgamation compiles with warnings at -O0 (-Wreturn-type) and -O1 (-Wmaybe-uninitialized)Possibly taken A pull request linked to this issue is open or already merged. Openarea:embed bug found-by:code-review
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
InauguralSystems/EigenScript#1775 ·
Maintainers usually reply within 1 day
-
scan_int_tokens line/col fields are untestedPossibly taken A pull request linked to this issue is open or already merged. Openarea:stdlib found-by:critic kind:gate-defect
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
InauguralSystems/EigenScript#1693 ·
Maintainers usually reply within 1 day
-
area:gfx bug
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
InauguralSystems/EigenScript#1684 ·
Maintainers usually reply within 1 day
All issues in InauguralSystems/EigenScript
Similar issues
-
[Issue]: hipsparselt.h C API as shipped now requires C23 -- ONLY because of missing include or guardOpen
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
ROCm/rocm-libraries#13736 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
Maintainers usually reply within 1 day
-
`inverse()` of a controlled `CUGate` drops the phase parameter γPossibly taken @rupasri118 claimed this today. Openbug mod: circuit
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Qiskit/qiskit#17223 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
OpenPrinting/libcupsfilters#284 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
libsdl-org/SDL#16530 ·
Maintainers usually reply within 1 day