Fix undefined behavior in StringView trimming and validate positive number parsing - #471
Open
jdymitarai wants to merge 1 commit into
Open
Fix undefined behavior in StringView trimming and validate positive number parsing#471jdymitarai wants to merge 1 commit into
jdymitarai wants to merge 1 commit into
Conversation
…umber parsing 1. Cast char to (unsigned char) in CpuFeatures_StringView_TrimWhitespace before calling isspace() to prevent undefined behavior with negative char values on platforms with signed char. 2. Reject empty views in ParsePositiveNumberWithBase, ensuring incomplete hex prefixes such as '0x' return -1 instead of erroneously returning 0. 3. Check for signed integer overflow in ParsePositiveNumberWithBase before multiplication. 4. Add comprehensive unit tests in string_view_test.cc covering non-ASCII whitespace trimming, hex validation, and integer overflow.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of Changes
Fix undefined behavior in StringView trimming:
<ctype.h>functions likeisspace()must be representable asunsigned charor equal toEOF.charis signed (default on x86/x64 MSVC and GCC/Clang), non-ASCII characters (>= 0x80) produce negative integer values when passed toisspace(), causing undefined behavior or debug assertions (e.g._ASSERTE((unsigned)(c + 1) <= 256)on MSVC).(unsigned char)before invokingisspace().Reject empty views in
ParsePositiveNumberWithBase:"0x"stripped the"0x"prefix leaving an empty remainder view (size == 0). The loop inParsePositiveNumberWithBasenever iterated and returnedresult = 0. As a result, the malformed literal"0x"was incorrectly treated as valid integer0instead of returning-1.-1ifview.size == 0ensures incomplete hex literals without digits properly fail.Prevent signed integer overflow in
ParsePositiveNumberWithBase:result > (INT_MAX - value) / base) beforeresult = (result * base) + valueto guard against signed integer overflow on oversized strings.Unit Tests:
test/string_view_test.ccfor non-ASCII whitespace trimming,"0","0x0","0x", malformed hex suffixes, and overflow inputs.Verification
All 17 unit tests in
string_view_testand all CMake test suites pass cleanly on MSVC.