Skip to content

Conversation

sasdf
Copy link

@sasdf sasdf commented Oct 17, 2024

movedelta(-1, 0);

zbar/zbar/img_scanner.c

Lines 861 to 866 in a549566

#define movedelta(dx, dy) \
do { \
x += (dx); \
y += (dy); \
p += (dx) + ((uintptr_t)(dy)*w); \
} while (0);

This expression movedelta(-1, 0); is expanded to

p += (-1) + ((uintptr_t)(0) * w);

where the RHS is evaluated unsigned as (uintptr_t) -1 i.e. 0xfff...

This pointer addition with unsigned wrap around is an undefined behavior in C.

In the latest clang trunk, the expr is optimized as a constant assignment ( p = -1; ), and segfault in runtime.
https://godbolt.org/z/G8xeMWTo5

This PR fixes the issue by casting the unsigned variable w to a signed type ptrdiff_t.
Given that dx and dy are both int, the RHS expression is evaluated as signed -1.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant