From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date: Mon, 21 Apr 2025 18:15:07 +0000 (-0300)
Subject: math: Fix UB in setayloadf
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=78ddfecdd552275deefcef7b896bfd669743fbe1;p=thirdparty%2Fglibc.git

math: Fix UB in setayloadf

The code can shift the 1U for value larger than 31 depending of
the exponent value.  Add a check prior the shift.
---

diff --git a/sysdeps/ieee754/flt-32/s_setpayloadf_main.c b/sysdeps/ieee754/flt-32/s_setpayloadf_main.c
index 700181c93a..25cae87eff 100644
--- a/sysdeps/ieee754/flt-32/s_setpayloadf_main.c
+++ b/sysdeps/ieee754/flt-32/s_setpayloadf_main.c
@@ -37,7 +37,8 @@ FUNC (float *x, float payload)
      except for 0 when allowed; (c) not an integer.  */
   if (exponent >= BIAS + PAYLOAD_DIG
       || (exponent < BIAS && !(SET_HIGH_BIT && ix == 0))
-      || (ix & ((1U << (BIAS + EXPLICIT_MANT_DIG - exponent)) - 1)) != 0)
+      || ((BIAS + EXPLICIT_MANT_DIG - exponent) < 32
+	  && (ix & ((1U << (BIAS + EXPLICIT_MANT_DIG - exponent)) - 1)) != 0))
     {
       SET_FLOAT_WORD (*x, 0);
       return 1;