Veracode complains integral overflow on line 533 of spdlog/include/spdlog/fmt/bundled/format-inl.h

Hi

This is the comment from Veracode for spdlog/include/spdlog/fmt/bundled/format-inl.h line 533:

borrow <<= bigit_bits;

"
Attack Vector: subNumber of Modules Affected: 1Description: This arithmetic operation results in an integer overflow error. Because the result of this calculation is larger than the maximum possible value for this data type, the result may wrap to become a very small, or negative number, therefore providing an unintended value. Integer overflows can often trigger buffer overflows, which can be exploited to execute arbitrary code."

Please verify if it's your intention or it's an bug as Veracode said.

Thanks.

David

Start by reading spdlog/include/spdlog/fmt/bundled/format-inl.h at line 533 and reviewing the Veracode report for the borrow <<= bigit_bits operation. Determine whether the reported overflow is intentional or a defect, then validate the conclusion against the surrounding formatting logic; done means the issue is resolved with a verified result.