Skip to content

Commit b389f01

Browse files
committed
Fix undefined behavior (integer overflow) in hash function.
If an intermediate hash value was 0xFFFFFFFF and we tried to add 1 as a signed addition, this technically triggers undefined behavior.
1 parent f7d0d06 commit b389f01

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

src/core/value.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,7 +322,8 @@ int32_t janet_hash(Janet x) {
322322
break;
323323
case JANET_TUPLE:
324324
hash = janet_tuple_hash(janet_unwrap_tuple(x));
325-
hash += (janet_tuple_flag(janet_unwrap_tuple(x)) & JANET_TUPLE_FLAG_BRACKETCTOR) ? 1 : 0;
325+
uint32_t inc = (janet_tuple_flag(janet_unwrap_tuple(x)) & JANET_TUPLE_FLAG_BRACKETCTOR) ? 1 : 0;
326+
hash = (int32_t)((uint32_t)hash + inc); /* avoid overflow undefined behavior */
326327
break;
327328
case JANET_STRUCT:
328329
hash = janet_struct_hash(janet_unwrap_struct(x));

0 commit comments

Comments
 (0)