Live data from Hacker News

IDIV DoS (INT_MIN / -1)

kqueue.org

21–24 of 24 posts

Re: IDIV DoS (INT_MIN / -1)

#21
post #20
post #6

If anyone here has used Second Life's scripting language LSL, they had to work around this issue. Apparently they now calculate x / -1 as -x instead, which gets a counter-intuitive result when x=INT_MIN but doesn't crash. I believe once upon a time this was documented and everything.

But -1*INT_MIN is still 1 greater than INT_MAX in two's complement ... so that's signed overflow and thus undefined behavior in C. Assuming x86 signed overflow behavior, you're just back to INT_MIN again? Or am I crazy?

The language in question isn't C, so they can have whatever semantics they want.

Re: IDIV DoS (INT_MIN / -1)

#23
post #14

Earlier quoted context omitted.

Regardless of undefined behavior, it should not crash the compiler.

Ah, I missed that it can crash the tcc compiler . Yeah, that's a bug.

Probably easy to miss. One really does not expect the compiler to crash on code like that.

Re: IDIV DoS (INT_MIN / -1)

#24
post #21
post #20

Earlier quoted context omitted.

But -1*INT_MIN is still 1 greater than INT_MAX in two's complement ... so that's signed overflow and thus undefined behavior in C. Assuming x86 signed overflow behavior, you're just back to INT_MIN again? Or am I crazy?

The language in question isn't C, so they can have whatever semantics they want.

Sorry, the use of the nym INT_MIN suggested to me that the implementation under the covers was C.

It looks like it was once an interpreter, but is now compiled down to CLR and run with Mono.

Post reply on HN