Skip to content

Fix signed integer overflow#465

Open
MichaelChirico wants to merge 4 commits into
jeroen:masterfrom
MichaelChirico:fix-signed-integer-overflow
Open

Fix signed integer overflow#465
MichaelChirico wants to merge 4 commits into
jeroen:masterfrom
MichaelChirico:fix-signed-integer-overflow

Conversation

@MichaelChirico

Copy link
Copy Markdown
Contributor

This was an error produced by a fuzzer we set up for yajl, fixed by Gemini, and ported to this bundled version by Gemini.


yajl_parse_integer was susceptible to signed integer overflow when parsing numbers close to or exceeding LLONG_MAX/LLONG_MIN limits. It performed multiplication and addition before checking if the result would overflow.

Solution:
Refactor the parsing loop in yajl_parse_integer to check for potential overflow before modifying the accumulator:

  • For positive numbers, check if multiplying by 10 or adding the next digit would exceed LLONG_MAX.
  • For negative numbers, accumulate as a negative value directly (to correctly handle LLONG_MIN which has larger absolute value than LLONG_MAX) and check if multiplying by 10 or subtracting the next digit would exceed LLONG_MIN.
  • Set errno to ERANGE and return the capped value (LLONG_MAX/LLONG_MIN) upon overflow, allowing the YAJL tree parser to fall back to double precision representation.

Check for overflow before multiplying and adding/subtracting digits.
@MichaelChirico MichaelChirico force-pushed the fix-signed-integer-overflow branch from 522f669 to 5b93275 Compare July 1, 2026 16:27
@MichaelChirico

MichaelChirico commented Jul 1, 2026

Copy link
Copy Markdown
Contributor Author

We could also use __builtin_mul_overflow here for a very clean solution, which is supported on clang and gcc, but not everywhere:

https://clang.llvm.org/docs/LanguageExtensions.html#checked-arithmetic-builtins

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant