Fix signed integer overflow in GLSL preprocessor left shift
Signed integer overflow is undefined in C++, whereas unsigned integer
overflow is not. Always cast left shift operand to unsigned to avoid
UB.
On common compilers, the behavior was already the same before this
patch, so this patch is done mostly for the benefit of automated fuzz
testing.
BUG=chromium:743136
TEST=angle_unittests
Change-Id: I7aab939036bb19a37f258cef4297b560da3cd9d5
Reviewed-on: https://chromium-review.googlesource.com/704659
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Commit-Queue: Olli Etuaho <oetuaho@nvidia.com>
diff --git a/src/compiler/preprocessor/ExpressionParser.y b/src/compiler/preprocessor/ExpressionParser.y
index 4dbc9e8..68d7cc3 100644
--- a/src/compiler/preprocessor/ExpressionParser.y
+++ b/src/compiler/preprocessor/ExpressionParser.y
@@ -233,14 +233,11 @@
}
$$ = static_cast<YYSTYPE>(0);
}
- else if ($1 < 0)
- {
- // Logical shift left.
- $$ = static_cast<YYSTYPE>(static_cast<UNSIGNED_TYPE>($1) << $3);
- }
else
{
- $$ = $1 << $3;
+ // Logical shift left. Casting to unsigned is needed to ensure there's no signed integer
+ // overflow, which some tools treat as an error.
+ $$ = static_cast<YYSTYPE>(static_cast<UNSIGNED_TYPE>($1) << $3);
}
}
| expression '-' expression {