Skip to content

Plugin (dancingparticles) - Signed integer overflows #287

Description

@kaixiong

UBSAN spots two signed integer overflows in two places within its beatdetector class.

Found by UBSAN:

dancingparticles/signal.cpp:32:8: runtime error: signed integer overflow: 65408 * 65408 cannot be represented in type 'int'
dancingparticles/signal.cpp:33:8: runtime error: signed integer overflow: 47316 * 47316 cannot be represented in type 'int'

In beatdetector::beatdetector():

for(int i=0;i<NUM_BANDS;i++)
{
    uint16_t f = i<128 ? (i-128) :0;    // <--- f underflows to produce a large unsigned number when i < 128
    f = f*f/100;                        // <--- overflow #1
    f = f*f/30;                         // <--- overflow #2
    filter[i] =f;
    //      cout << f<<endl;
    filterpower+=f;
}

There is an identical issue in beatdetector::learnbeat().

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions