From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Mon, 1 Mar 2021 19:18:13 +0000 (+0000)
Subject: Yes if len == 0 then SIGN_BIT_HIGH produces an invalid shift, but len is never 0... 
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a3aa1e5b056443b10abbf8b2d09e67ede1380b82;p=thirdparty%2Ffreeradius-server.git

Yes if len == 0 then SIGN_BIT_HIGH produces an invalid shift, but len is never 0, so...
---

diff --git a/src/lib/util/value.c b/src/lib/util/value.c
index 094ad195b68..7c61c7aee27 100644
--- a/src/lib/util/value.c
+++ b/src/lib/util/value.c
@@ -2561,10 +2561,33 @@ static inline int fr_value_box_cast_integer_to_integer(UNUSED TALLOC_CTX *ctx, f
 	size_t			len = fr_value_box_field_sizes[src->type];
 	int64_t			min;
 
-#define SIGN_BIT_HIGH(_int, _len)	((((uint64_t)1) << ((_len << 3) - 1)) & _int)
+#define SIGN_BIT_HIGH(_int, _len)	((((uint64_t)1) << (((_len) << 3) - 1)) & (_int))
 #define SIGN_PROMOTE(_int, _len)	((_len) < sizeof(_int) ? \
 					(_int) | (~((__typeof__(_int))0)) << ((_len) << 3) : (_int))
 
+#if !defined(NDEBUG) || defined(__clang_analyzer__)
+	/*
+	 *	Helps catch invalid fr_value_box_field_sizes
+	 *	entries, and shuts up clang analyzer.
+	 */
+	if (unlikely(len == 0)) {
+		fr_strerror_printf("Invalid cast from %s to %s.  %"PRId64" "
+				   "invalid source type len, expected > 0, got %zu",
+				   fr_table_str_by_value(fr_value_box_type_table, src->type, "<INVALID>"),
+				   fr_table_str_by_value(fr_value_box_type_table, dst_type, "<INVALID>"),
+				   len);
+		return -1;
+	}
+	if (unlikely(len > sizeof(uint64_t))) {
+		fr_strerror_printf("Invalid cast from %s to %s.  %"PRId64" "
+				   "invalid source type len, expected <= %zu, got %zu",
+				   fr_table_str_by_value(fr_value_box_type_table, src->type, "<INVALID>"),
+				   fr_table_str_by_value(fr_value_box_type_table, dst_type, "<INVALID>"),
+				   sizeof(uint64_t), len);
+		return -1;
+	}
+#endif
+
 	switch (src->type) {
 	/*
 	 *	Dates are always represented in nanoseconds