Reported by Bruno Haible.
https://lists.gnu.org/archive/html/bug-gnulib/2019-03/msg00017.html
* lib/bitset/table.c (tbitset_test): last_bit is the position of
the bit in the array of bitset_word, so be sure to take its modulo
number-of-bits-in-bitset-word (i.e., EBITSET_ELT_WORDS).
* lib/bitset/list.c (lbitset_unused_clear): Likewise.
+2019-03-16 Akim Demaille <akim@lrde.epita.fr>
+
+ bitset: fix overflows.
+ Reported by Bruno Haible.
+ https://lists.gnu.org/archive/html/bug-gnulib/2019-03/msg00017.html
+ * lib/bitset/table.c (tbitset_test): last_bit is the position of
+ the bit in the array of bitset_word, so be sure to take its modulo
+ number-of-bits-in-bitset-word (i.e., EBITSET_ELT_WORDS).
+ * lib/bitset/list.c (lbitset_unused_clear): Likewise.
+
2019-03-14 Akim Demaille <akim@lrde.epita.fr>
bitset: style changes.
bitset_word *srcp = elt->words;
bitset_windex windex = n_bits / BITSET_WORD_BITS;
- srcp[windex - elt->index] &= ((bitset_word) 1 << last_bit) - 1;
+ srcp[windex - elt->index]
+ &= ((bitset_word) 1 << (last_bit % BITSET_WORD_BITS)) - 1;
windex++;
for (; (windex - elt->index) < LBITSET_ELT_WORDS; windex++)
bitset_windex windex = n_bits / BITSET_WORD_BITS;
bitset_windex woffset = eindex * EBITSET_ELT_WORDS;
- srcp[windex - woffset] &= ((bitset_word) 1 << last_bit) - 1;
+ srcp[windex - woffset]
+ &= ((bitset_word) 1 << (last_bit % BITSET_WORD_BITS)) - 1;
windex++;
for (; (windex - woffset) < EBITSET_ELT_WORDS; windex++)
srcp[windex - woffset] = 0;