Integer overflow in functor/3

--00000000000081a15005b41f53c0
Content-Type: text/plain; charset="UTF-8"

Hi all,

I've found a minor bug in functor/3.  With an arity argument outside the
range of an int, the value is truncated into the size of an int.

Here are two examples of potential outcomes, along with a correct example
that doesn't have overflow:

| ?- X is 1<<32 + 3, functor(F, hi, X).

F = hi(_,_,_)
X = 4294967299

yes
| ?- X is 1<<31, functor(F, hi, X).
uncaught exception: error(type_error(atom,hi),functor/3)
| ?- X is 1<<31 - 1, functor(F, hi, X).
uncaught exception: error(representation_error(max_arity),functor/3)

I would expect all of these to be representation_errors.  The second
example happens because of  a catch-all error clause in Pl_Blt_Functor
(term_inl_c.c, line 282):

  // ... checks if arity > 0 and functor_word is valid
  if (arity != 0)
    Pl_Err_Type(pl_type_atom, functor_word);

The root cause is that arity is declared as an integer, instead of a PlLong
(term_inl_c.c, line 225):

  int arity;

Thanks, and I hope the bug report helps.

-Mark

--00000000000081a15005b41f53c0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi all,</div><div><br></div><div>I&#39;ve found a min=
or bug in functor/3.=C2=A0 With an arity argument outside the range of an i=
nt, the value is truncated into the size of an int.</div><div><br></div><di=
v>Here are two examples of potential outcomes, along with a correct example=
 that doesn&#39;t have overflow:<br></div><div><br></div><div>| ?- X is 1&l=
t;&lt;32 + 3, functor(F, hi, X).<br><br>F =3D hi(_,_,_)<br>X =3D 4294967299=
<br><br>yes<br>| ?- X is 1&lt;&lt;31, functor(F, hi, X). =C2=A0 =C2=A0<br>u=
ncaught exception: error(type_error(atom,hi),functor/3)</div><div>| ?- X is=
 1&lt;&lt;31 - 1, functor(F, hi, X).<br>uncaught exception: error(represent=
ation_error(max_arity),functor/3)</div><div><br></div><div>I would expect a=
ll of these to be representation_errors.=C2=A0 The second example happens b=
ecause of=C2=A0 a catch-all error clause in Pl_Blt_Functor (term_inl_c.c, l=
ine 282):<br><br></div><div>=C2=A0 // ... checks if arity &gt; 0 and functo=
r_word is valid<br></div><div>=C2=A0 if (arity !=3D 0)<br>=C2=A0 =C2=A0 Pl_=
Err_Type(pl_type_atom, functor_word);<br><br></div><div>The root cause is t=
hat arity is declared as an integer, instead of a PlLong (term_inl_c.c, lin=
e 225):</div><div><br></div><div>=C2=A0 int arity;</div><div><br></div><div=
>Thanks, and I hope the bug report helps.</div><div><br></div><div>-Mark<br=
></div></div>

--00000000000081a15005b41f53c0--