From: Christopher Faulet <cfaulet@haproxy.com>
Date: Mon, 17 Jul 2023 06:35:11 +0000 (+0200)
Subject: BUG/MINOR: sample: Fix wrong overflow detection in add/sub conveters
X-Git-Tag: v2.9-dev2~49
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b982fc21770d433a2edfac1336974d289316b271;p=thirdparty%2Fhaproxy.git

BUG/MINOR: sample: Fix wrong overflow detection in add/sub conveters

When "add" or "sub" conveters are used, an overflow detection is performed.
When 2 negative integers are added (or a positive integer is substracted to
a positive one), we take care to not exceed the low limit (LLONG_MIN) and
when 2 positive integers are added, we take care to not exceed the high
limit (LLONG_MAX).

However, because of a missing 'else' statement, if there is no overflow in
the first case, we fall back on the second check (the one for positive adds)
and LLONG_MAX is returned. It means that most of time, when 2 negative
integers are added (or a positive integer is substracted to a negative one),
LLONG_MAX is returned.

This patch should solve the issue #2216. It must be backported to all stable
versions.
---

diff --git a/src/sample.c b/src/sample.c
index 097f647b3c..34c18a6b39 100644
--- a/src/sample.c
+++ b/src/sample.c
@@ -2990,12 +2990,12 @@ static inline long long int arith_add(long long int a, long long int b)
 	 * +------+----------+----------+
 	 */
 	if ((a ^ b) >= 0) {
-		/* signs are different. */
+		/* signs are same. */
 		if (a < 0) {
 			if (LLONG_MIN - a > b)
 				return LLONG_MIN;
 		}
-		if (LLONG_MAX - a < b)
+		else if (LLONG_MAX - a < b)
 			return LLONG_MAX;
 	}
 	return a + b;