From 78ddfecdd552275deefcef7b896bfd669743fbe1 Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Mon, 21 Apr 2025 15:15:07 -0300 Subject: [PATCH] math: Fix UB in setayloadf The code can shift the 1U for value larger than 31 depending of the exponent value. Add a check prior the shift. --- sysdeps/ieee754/flt-32/s_setpayloadf_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sysdeps/ieee754/flt-32/s_setpayloadf_main.c b/sysdeps/ieee754/flt-32/s_setpayloadf_main.c index 700181c93a..25cae87eff 100644 --- a/sysdeps/ieee754/flt-32/s_setpayloadf_main.c +++ b/sysdeps/ieee754/flt-32/s_setpayloadf_main.c @@ -37,7 +37,8 @@ FUNC (float *x, float payload) except for 0 when allowed; (c) not an integer. */ if (exponent >= BIAS + PAYLOAD_DIG || (exponent < BIAS && !(SET_HIGH_BIT && ix == 0)) - || (ix & ((1U << (BIAS + EXPLICIT_MANT_DIG - exponent)) - 1)) != 0) + || ((BIAS + EXPLICIT_MANT_DIG - exponent) < 32 + && (ix & ((1U << (BIAS + EXPLICIT_MANT_DIG - exponent)) - 1)) != 0)) { SET_FLOAT_WORD (*x, 0); return 1; -- 2.47.2