Fix OOB shifts in fd_vm_interp_core (#3872) #6865
Open
+4
−4
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Fixes out-of-bounds (OOB) shift operations in the VM interpreter that were causing UBSan errors.
Closes #3872
Problem
The VM interpreter had 4 arithmetic right shift (ARSH) operations using raw C shift operators without bounds checking:
0xc4(ARSH_IMM):(int)reg_dst >> imm0xc7(ARSH64_IMM):(long)reg_dst >> imm0xcc(ARSH_REG):(int)reg_dst >> (uint)reg_src0xcf(ARSH64_REG):(long)reg_dst >> reg_srcWhen shift amounts ≥ bit width (32 for int, 64 for long), this caused undefined behavior and UBSan errors:
Solution
Replaced raw shift operators with safe helper functions from
fd_bits.h:fd_int_shift_right()for 32-bit shiftsfd_long_shift_right()for 64-bit shiftsThese functions cap shift amounts to prevent UB while preserving arithmetic right shift semantics.
Changes
src/flamenco/vm/fd_vm_interp_core.c: Fixed 4 ARSH operations (lines 972, 985, 989, 1003)Testing