tail: arithmetic overflow (overflow-checks) on `-c -N` with N = 2^63 (i64::MIN negate)
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 24.1k
- Forks
- 2k
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 365
Description
tail -c -9223372036854775808 FILE panics with attempt to negate with overflow under overflow-checks.
$ yes | head -c 8192 > f # a regular file LARGER than the block size (~4 KiB)
$ # debug build (overflow-checks on by default) — clean-rebuild to avoid a stale binary
$ cargo build -q -p uu_tail --bin tail
$ ./target/debug/tail -c -9223372036854775808 f >/dev/null
thread 'main' panicked at src/uu/tail/src/tail.rs:472:17:
attempt to negate with overflow
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
$ echo $?
101
Root cause
In bounded_tail, the Bytes(Negative(count)) arm computes the seek offset as -(*count as i64); for count = 9223372036854775808 (2^63), count as i64 is i64::MIN, and negating i64::MIN overflows i64. A debug (or release + -C overflow-checks) build aborts (exit 101); a normal release build wraps silently and exits 0.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/uu/tail/src/tail.rs around lines 471-476 and inspect the bounded_tail Bytes(Negative(count)) branch. Reproduce the issue with the cargo build command and the 2^63-byte tail invocation from the report, then verify the debug build no longer panics or exits 101 for that input.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 88/100