Bug: Negation in 'luaV_shiftr' may overflow

roberto-ieru · roberto-ieru · commit 62fb93442753 · 2021-07-22T13:44:53.000-03:00
Negation of an unchecked lua_Integer overflows with mininteger.
diff --git a/lvm.c b/lvm.c
@@ -766,7 +766,7 @@ lua_Number luaV_modf (lua_State *L, lua_Number m, lua_Number n) {
 /*
 ** Shift left operation. (Shift right just negates 'y'.)
 */
-#define luaV_shiftr(x,y)	luaV_shiftl(x,-(y))
+#define luaV_shiftr(x,y)	luaV_shiftl(x,intop(-, 0, y))
 
 lua_Integer luaV_shiftl (lua_Integer x, lua_Integer y) {
   if (y < 0) {  /* shift right? */
diff --git a/testes/bitwise.lua b/testes/bitwise.lua
@@ -45,6 +45,11 @@ assert(-1 >> numbits == 0 and
        -1 << numbits == 0 and
        -1 << -numbits == 0)
 
+assert(1 >> math.mininteger == 0)
+assert(1 >> math.maxinteger == 0)
+assert(1 << math.mininteger == 0)
+assert(1 << math.maxinteger == 0)
+
 assert((2^30 - 1) << 2^30 == 0)
 assert((2^30 - 1) >> 2^30 == 0)
 
