Re: [PATCH] left shift of negative value do_binop src/arith_yacc.c:111:12

31/07/25 21:45, Aleksander Ushakov wrote:
> Hello Dash maintainers,
> 
> I encountered a bug in Dash in commit b4ef25d7 and would like to report
> it. The details are provided below.
> 
> arith_yacc.c:111:12: runtime error: left shift of negative value -1
> 
>      #0 0x601249d1d2d1 in do_binop /upstream/ubsan/dash/src/ 
> arith_yacc.c:111:12
>      #1 0x601249d1da48 in binop2 /upstream/ubsan/dash/src/arith_yacc.c: 
> 194:20
>      #2 0x601249d1da1b in binop2 /upstream/ubsan/dash/src/arith_yacc.c: 
> 190:8
>      #3 0x601249d1d615 in binop /upstream/ubsan/dash/src/arith_yacc.c:212:9
>      #4 0x601249d1d50e in and /upstream/ubsan/dash/src/arith_yacc.c:217:15
>      #5 0x601249d1d43e in or /upstream/ubsan/dash/src/arith_yacc.c:234:15
>      #6 0x601249d1cf5e in cond /upstream/ubsan/dash/src/arith_yacc.c:251:15
>      #7 0x601249d1ce10 in assignment /upstream/ubsan/dash/src/ 
> arith_yacc.c:278:10
>      #8 0x601249d1cd93 in arith /upstream/ubsan/dash/src/arith_yacc.c: 
> 298:11
>      #9 0x601249d368df in expari /upstream/ubsan/dash/src/expand.c:520:11
>      #10 0x601249d3092e in argstr /upstream/ubsan/dash/src/expand.c:397:8
>      #11 0x601249d2f6ab in expandarg /upstream/ubsan/dash/src/expand.c: 
> 232:2
>      #12 0x601249d2800d in fill_arglist /upstream/ubsan/dash/src/eval.c: 
> 680:3
>      #13 0x601249d21eb1 in evalcommand /upstream/ubsan/dash/src/eval.c: 
> 788:13
>      #14 0x601249d210ac in evaltree /upstream/ubsan/dash/src/eval.c:305:12
>      #15 0x601249d4d18c in cmdloop /upstream/ubsan/dash/src/main.c:246:8
> 
>      #16 0x601249d4ce4b in main /upstream/ubsan/dash/src/main.c:180:3
> 
>      #17 0x761de6eac249 in __libc_start_call_main csu/../sysdeps/nptl/ 
> libc_start_call_main.h:58:16
>      #18 0x761de6eac304 in __libc_start_main csu/../csu/libc-start.c:360:3
>      #19 0x601249cef930 in _start (/upstream/ubsan/dash/src/ 
> dash+0x42930) (BuildId: 2fb8fb410aebcc20429dc4b85194b8ca2dc00a3e)
> 
> 
> 
> SUMMARY: UndefinedBehaviorSanitizer: invalid-shift-base arith_yacc.c:111:12
> Aborted (core dumped)
> 
> 
> Environment:
> 
> Debian-12, x86-64
> clang-19 compiler
> 
> Steps to reproduce:
> 
> ./autogen.sh
> CC=clang CFLAGS=" -fsanitize=undefined -g " ./configure --disable- 
> fnmatch --disable-lineno --disable-glob
> make
> cd src
> echo -ne '$((0|~0<<(0)))' | ./dash

There is a fix of the problem:

diff --git a/src/arith_yacc.c b/src/arith_yacc.c
index 1a087c3..e23060d 100644
--- a/src/arith_yacc.c
+++ b/src/arith_yacc.c
@@ -108,7 +108,9 @@ static intmax_t do_binop(int op, intmax_t a, intmax_t b)
         case ARITH_SUB:
                 return a - b;
         case ARITH_LSHIFT:
-               return a << b;
+               if (a < 0)
+                       yyerror("left shift of negative value");
+               return (intmax_t)a << b;
         case ARITH_RSHIFT:
                 return a >> b;
         case ARITH_LT:

Same case is placed in DIV branch (when divide on zero). I think it is 
analogue.