fix signed overflow negating INT64_MIN in json_object_int_inc

diff --git a/json_object.c b/json_object.c
index 0a619679bd7ea9f0499bdbe1cfc0e55fdd3c1301..4c6db9bf25be761b0f13a1f157e871eab30b84cd 100644 (file)
--- a/json_object.c
+++ b/json_object.c
@@ -1113,14 +1113,14 @@ int json_object_int_inc(struct json_object *jso, int64_t val)
                {
                        jsoint->cint.c_uint64 = UINT64_MAX;
                }
-               else if (val < 0 && jsoint->cint.c_uint64 < (uint64_t)(-val))
+               else if (val < 0 && jsoint->cint.c_uint64 < (0 - (uint64_t)val))
                {
                        jsoint->cint.c_int64 = (int64_t)jsoint->cint.c_uint64 + val;
                        jsoint->cint_type = json_object_int_type_int64;
                }
-               else if (val < 0 && jsoint->cint.c_uint64 >= (uint64_t)(-val))
+               else if (val < 0 && jsoint->cint.c_uint64 >= (0 - (uint64_t)val))
                {
-                       jsoint->cint.c_uint64 -= (uint64_t)(-val);
+                       jsoint->cint.c_uint64 -= (0 - (uint64_t)val);
                }
                else
                {

diff --git a/tests/test_int_add.c b/tests/test_int_add.c
index 142feacb6e9fa50f4e0ea9bea9f7f1c855a4fc39..be3f5c06ce5d6ab39ed923818b3b265012b60b73 100644 (file)
--- a/tests/test_int_add.c
+++ b/tests/test_int_add.c
@@ -68,6 +68,17 @@ int main(int argc, char **argv)
        assert(json_object_get_uint64(tmp) == 0);
        json_object_put(tmp);
        printf("UINT64 ADD UNDERFLOW PASSED\n");
+       // Decrement by INT64_MIN: -val would overflow int64_t, so the magnitude
+       // has to be taken in unsigned space.
+       tmp = json_object_new_uint64(100);
+       json_object_int_inc(tmp, INT64_MIN);
+       assert(json_object_get_int64(tmp) == INT64_MIN + 100);
+       json_object_put(tmp);
+       tmp = json_object_new_uint64(UINT64_MAX);
+       json_object_int_inc(tmp, INT64_MIN);
+       assert(json_object_get_uint64(tmp) == (uint64_t)INT64_MAX);
+       json_object_put(tmp);
+       printf("UINT64 ADD INT64_MIN PASSED\n");
 
        printf("PASSED\n");
        return 0;

diff --git a/tests/test_int_add.expected b/tests/test_int_add.expected
index f9348d4b097a085cd38dd99b8d411b4952dbbf3a..34b8edfbb862adcff0cfad549252306fc85bc0a4 100644 (file)
--- a/tests/test_int_add.expected
+++ b/tests/test_int_add.expected
@@ -7,4 +7,5 @@ INT64 ADD UNDERFLOW PASSED
 UINT64 ADD PASSED
 UINT64 ADD OVERFLOW PASSED
 UINT64 ADD UNDERFLOW PASSED
+UINT64 ADD INT64_MIN PASSED
 PASSED