microsoft / microsoft/calculator
Integer overflow in negation in ratpowi32()
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 31.1k
- Forks
- 5.8k
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
Some integer a^b operations can crash calc due to exhaustion of stack space.
Steps To Reproduce
- Launch calc
- Switch to scientific mode
- Type in:
(-1)^(-2^31)=
Expected behavior
Output should be 1.
Device and Application Information
- OS Build: 10.0.26100.0
- Architecture: X64
- Application Version: 11.2607.0.0
- Region: en-US
- Dev Version Installed: False
Additional context
Event log excerpt:
Faulting application name: CalculatorApp.exe, version: 11.2607.0.0, time stamp: 0x6a736ec2
Faulting module name: SharedLibrary.dll, version: 2.2.29512.0, time stamp: 0x5fad1a6e
Exception code: 0x00001007
Fault offset: 0x00000000007e38de
Bug is here:
When power is INT_MIN, negating it results in INT_MIN again, thus still negative, recursing endlessly.
Requested Assignment
I'm just reporting this problem. I don't want to fix it.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at src/CalcManager/Ratpack/conv.cpp around line 1507 and reproduce the scientific-mode expression (-1)^(-2^31)= in Calculator. Trace the negation of INT_MIN and verify that the fix prevents recursion exhaustion and produces 1 for the reported input.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- desktop
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 76/100