apache / apache/trafficserver

CID 1508885: Unintentional integer overflow

Open
#10,425 1 comment 0 reactions 1 assignee Claimed by @SolidWallOfCode View on GitHub
Bug Coverity Stale
Dominant language
C++
Stars
2k
Forks
874
Avg merge
6d 15h
Merged PRs (30d)
46

Description

Histogram.h
```
167template
168auto
169Histogram::min_for_bucket(unsigned idx) -> raw_type
170{
171 auto range = idx / N_SPAN_BUCKETS;
172 raw_type base = 0; // minimum value for the range (not span!).
173 raw_type span_size = 1; // for @a range 0 or 1
174 if (range > 0) {

CID 1508885 (#1 of 1): Unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)
overflow_before_widen: Potentially overflowing expression 1 << range + 2UL - 1UL with type int (32 bits, signed) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type ts::Histogram<7, 2>::raw_type (64 bits, unsigned).
To avoid overflow, cast 1 to type ts::Histogram<7, 2>::raw_type.
175 base = 1 << (range + N_SPAN_BITS - 1);
176 if (range > 1) { // at @a range == 1 this would be 0, which is wrong.
177 span_size = base >> N_SPAN_BITS;
178 }
179 }
180 return base + span_size * (idx & SPAN_MASK);
181}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.