-
Notifications
You must be signed in to change notification settings - Fork 100
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix signed integer overflow in RV32IM #324
Fix signed integer overflow in RV32IM #324
Conversation
The implementation of add, sub, and addi instructions incorrectly used int32_t for arithmetic operations, leading to signed integer overflow. Address the issue by maintaining the uint32_t type for arithmetic operations, ensuring compliance with the laws of arithmetic modulo 2^n. This approach prevents undefined behavior resulting from signed integer overflow.
The current implementation of the mul instruction does not guard against integer overflow, potentially leading to undefined behavior. Cast the operands to int64_t before performing the multiplication to ensure that the result can be accommodated without overflow. The lower 32 bits of the product are then extracted, preserving the correct uint32_t type.
I defer to @qwe661234 for conformation. Meanwhile, I am thinking of enabling more checks about undefined behavior in CI pipeline. |
This modification seems reasonable, but we need a test case to verify it. |
I observe this undefined behavior in several prebuilt ELF binaries. Taking scimark2.elf as an example, by adding
|
Additionally, if the
|
Perhaps we can consider incorporating UBSAN along with prebuilt ELF binaries for testing in CI. Alternatively, we may reconsider using a fuzzer for detection. See: #267 |
Cc. @henrybear327 |
UBSAN has identified several signed integer overflow issues in the RV32IM implementation, including incorrect type conversions to int32_t for add/sub operations and a lack of prevention for overflow in multiplication.
Address these issues by ensuring proper type handling and preventing integer overflow in the RV32IM implementation.