[BUG] left shift of negative value do_binop src/arith_yacc.c:111:12

Aleksander Ushakov <[email protected]> Thu, 31 Jul 2025 21:45:59 +0300
Newsgroups org.kernel.vger.dash
Message-ID <[email protected]>
Hello Dash maintainers,

I encountered a bug in Dash in commit b4ef25d7 and would like to report
it. The details are provided below.

arith_yacc.c:111:12: runtime error: left shift of negative value -1

     #0 0x601249d1d2d1 in do_binop 
/upstream/ubsan/dash/src/arith_yacc.c:111:12
     #1 0x601249d1da48 in binop2 
/upstream/ubsan/dash/src/arith_yacc.c:194:20
     #2 0x601249d1da1b in binop2 /upstream/ubsan/dash/src/arith_yacc.c:190:8
     #3 0x601249d1d615 in binop /upstream/ubsan/dash/src/arith_yacc.c:212:9
     #4 0x601249d1d50e in and /upstream/ubsan/dash/src/arith_yacc.c:217:15
     #5 0x601249d1d43e in or /upstream/ubsan/dash/src/arith_yacc.c:234:15
     #6 0x601249d1cf5e in cond /upstream/ubsan/dash/src/arith_yacc.c:251:15
     #7 0x601249d1ce10 in assignment 
/upstream/ubsan/dash/src/arith_yacc.c:278:10
     #8 0x601249d1cd93 in arith /upstream/ubsan/dash/src/arith_yacc.c:298:11
     #9 0x601249d368df in expari /upstream/ubsan/dash/src/expand.c:520:11
     #10 0x601249d3092e in argstr /upstream/ubsan/dash/src/expand.c:397:8
     #11 0x601249d2f6ab in expandarg /upstream/ubsan/dash/src/expand.c:232:2
     #12 0x601249d2800d in fill_arglist 
/upstream/ubsan/dash/src/eval.c:680:3
     #13 0x601249d21eb1 in evalcommand 
/upstream/ubsan/dash/src/eval.c:788:13
     #14 0x601249d210ac in evaltree /upstream/ubsan/dash/src/eval.c:305:12
     #15 0x601249d4d18c in cmdloop /upstream/ubsan/dash/src/main.c:246:8

     #16 0x601249d4ce4b in main /upstream/ubsan/dash/src/main.c:180:3

     #17 0x761de6eac249 in __libc_start_call_main 
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
     #18 0x761de6eac304 in __libc_start_main csu/../csu/libc-start.c:360:3
     #19 0x601249cef930 in _start 
(/upstream/ubsan/dash/src/dash+0x42930) (BuildId: 
2fb8fb410aebcc20429dc4b85194b8ca2dc00a3e)



SUMMARY: UndefinedBehaviorSanitizer: invalid-shift-base arith_yacc.c:111:12
Aborted (core dumped)


Environment:

Debian-12, x86-64
clang-19 compiler

Steps to reproduce:

./autogen.sh
CC=clang CFLAGS=" -fsanitize=undefined -g " ./configure 
--disable-fnmatch --disable-lineno --disable-glob
make
cd src
echo -ne '$((0|~0<<(0)))' | ./dash