Skip to content

Fix memtable_list Unsigned difference expression compared to zero #13623

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

odaysec
Copy link

@odaysec odaysec commented May 18, 2025

if (current_->memlist_.size() - num_flush_not_started_ > 0) {

Fix the issue need to ensure that the subtraction does not result in unsigned underflow. The best approach is to cast the result of the subtraction to a signed type (e.g., int64_t) before performing the comparison. This ensures that the subtraction behaves as expected, even if num_flush_not_started_ is greater than current_->memlist_.size(). The fix involves modifying line 402 to cast the result of the subtraction to int64_t before comparing it to 0.

uint32_t limit = get_limit();
uint32_t total = 0;

while (limit - total > 0) { // BAD: if `total` is greater than `limit` this will underflow and continue executing the loop.
  total += get_data();
}

while (total < limit) { // GOOD: never underflows here because there is no arithmetic.
  total += get_data();
}

while ((int64_t)limit - total > 0) { // GOOD: never underflows here because the result always fits in an `int64_t`.
  total += get_data();
}

References

INT02-C. Understand integer conversion rules
CWE-191

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants