From 5ae9c869b0f72e3d10b2b73263e04b160f239cc8 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Wed, 7 May 2025 16:04:23 +0000 Subject: [PATCH] math: Fix UB in ldbl-128 __ieee754_rem_pio2l UBSAN: Undefined behaviour in ../sysdeps/ieee754/ldbl-128ibm/e_rem_pio2l.c:254:27 left shift of 325455441821696 by 23 cannot be represented in type 'long int' --- sysdeps/ieee754/ldbl-128ibm/e_rem_pio2l.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sysdeps/ieee754/ldbl-128ibm/e_rem_pio2l.c b/sysdeps/ieee754/ldbl-128ibm/e_rem_pio2l.c index d65d94bb62..db7f59d5b4 100644 --- a/sysdeps/ieee754/ldbl-128ibm/e_rem_pio2l.c +++ b/sysdeps/ieee754/ldbl-128ibm/e_rem_pio2l.c @@ -249,11 +249,11 @@ int32_t __ieee754_rem_pio2l(long double x, long double *y) /* This is faster than doing this in floating point, because we have to convert it to integers anyway and like this we can keep both integer and floating point units busy. */ - tx [0] = (double)(((ixd >> 25) & 0x7fffff) | 0x800000); - tx [1] = (double)((ixd >> 1) & 0xffffff); - tx [2] = (double)(((ixd << 23) | (lxd >> 41)) & 0xffffff); - tx [3] = (double)((lxd >> 17) & 0xffffff); - tx [4] = (double)((lxd << 7) & 0xffffff); + tx [0] = (double)((((uint64_t)ixd >> 25) & 0x7fffff) | 0x800000); + tx [1] = (double)(((uint64_t)ixd >> 1) & 0xffffff); + tx [2] = (double)((((uint64_t)ixd << 23) | (lxd >> 41)) & 0xffffff); + tx [3] = (double)(((uint64_t)lxd >> 17) & 0xffffff); + tx [4] = (double)(((uint64_t)lxd << 7) & 0xffffff); n = __kernel_rem_pio2 (tx, tx + 5, exp, ((lxd << 7) & 0xffffff) ? 5 : 4, 3, two_over_pi); -- 2.47.2