Handle constexpr shift left 0 of max bits
__builtin_clz(0) is undefined and was causing a failure to be missed
locally, but it was caught by the fuzzer.
Handle the 0 case by returning the max number of bits in that type.
Make sure left shift exponent doesn't excede the number of bits in the
type when it is 0.
Test: aidl_parser_fuzzer tests/corpus/shift_zero_left_32
Fixes: 169905365
Change-Id: If3f22c423b0b1904be4aa91b178c7a0eb2f0f8ec
diff --git a/aidl_const_expressions.cpp b/aidl_const_expressions.cpp
index bac8dac..a3d1a01 100644
--- a/aidl_const_expressions.cpp
+++ b/aidl_const_expressions.cpp
@@ -38,6 +38,8 @@
template <typename T>
constexpr int CLZ(T x) {
+ // __builtin_clz(0) is undefined
+ if (x == 0) return sizeof(T) * 8;
return (sizeof(T) == sizeof(uint64_t)) ? __builtin_clzl(x) : __builtin_clz(x);
}
@@ -113,7 +115,7 @@
return mValue >> o;
}
T operator<<(T o) {
- if (o < 0 || mValue < 0 || o > CLZ(mValue)) {
+ if (o < 0 || mValue < 0 || o > CLZ(mValue) || o >= static_cast<T>(sizeof(T) * 8)) {
mOverflowed = true;
return 0;
}