From 68cc43e4ffda1f0f6e2f15b6b5b449a7d605c288 Mon Sep 17 00:00:00 2001 From: Akim Demaille Date: Sat, 16 Mar 2019 17:16:48 +0100 Subject: [PATCH] bitset: fix overflows Reported by Bruno Haible. https://lists.gnu.org/archive/html/bug-gnulib/2019-03/msg00017.html * lib/bitset/table.c (tbitset_test): last_bit is the position of the bit in the array of bitset_word, so be sure to take its modulo number-of-bits-in-bitset-word (i.e., EBITSET_ELT_WORDS). * lib/bitset/list.c (lbitset_unused_clear): Likewise. --- ChangeLog | 10 ++++++++++ lib/bitset/list.c | 3 ++- lib/bitset/table.c | 3 ++- 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index a3fbce6e74..ff1e5f4dd4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,13 @@ +2019-03-16 Akim Demaille + + bitset: fix overflows. + Reported by Bruno Haible. + https://lists.gnu.org/archive/html/bug-gnulib/2019-03/msg00017.html + * lib/bitset/table.c (tbitset_test): last_bit is the position of + the bit in the array of bitset_word, so be sure to take its modulo + number-of-bits-in-bitset-word (i.e., EBITSET_ELT_WORDS). + * lib/bitset/list.c (lbitset_unused_clear): Likewise. + 2019-03-14 Akim Demaille bitset: style changes. diff --git a/lib/bitset/list.c b/lib/bitset/list.c index f42edb8ea3..fe1b52869b 100644 --- a/lib/bitset/list.c +++ b/lib/bitset/list.c @@ -859,7 +859,8 @@ lbitset_unused_clear (bitset dst) bitset_word *srcp = elt->words; bitset_windex windex = n_bits / BITSET_WORD_BITS; - srcp[windex - elt->index] &= ((bitset_word) 1 << last_bit) - 1; + srcp[windex - elt->index] + &= ((bitset_word) 1 << (last_bit % BITSET_WORD_BITS)) - 1; windex++; for (; (windex - elt->index) < LBITSET_ELT_WORDS; windex++) diff --git a/lib/bitset/table.c b/lib/bitset/table.c index a129c8712a..9cac964694 100644 --- a/lib/bitset/table.c +++ b/lib/bitset/table.c @@ -778,7 +778,8 @@ tbitset_unused_clear (bitset dst) bitset_windex windex = n_bits / BITSET_WORD_BITS; bitset_windex woffset = eindex * EBITSET_ELT_WORDS; - srcp[windex - woffset] &= ((bitset_word) 1 << last_bit) - 1; + srcp[windex - woffset] + &= ((bitset_word) 1 << (last_bit % BITSET_WORD_BITS)) - 1; windex++; for (; (windex - woffset) < EBITSET_ELT_WORDS; windex++) srcp[windex - woffset] = 0; -- 2.39.5