[v2 PATCH] arith: Fix CVE-2026-31323 INTMAX_MIN / -1 overflow

On Wed, Apr 08, 2026 at 04:47:10PM +0800, 都觉得就到家 wrote:
> Division and remainder currently guard against division by zero, but not
> against the signed overflow case INTMAX_MIN / -1. On affected systems
> this can trigger SIGFPE during arithmetic expansion.
> 
> Add an explicit guard before evaluating division or remainder.
> 
> Signed-off-by: Muchen Hou <[email protected]&gt;

Thanks for the patch.  For future submissions please send your
email as plain-text, as otherwise it will be rejected by the
mailing list.

I'm resending your patch with an additional change to combine it
with the existing divide by zero check:

---8<---
From: Muchen Hou <[email protected]>

Division and remainder currently guard against division by zero, but not
against the signed overflow case INTMAX_MIN / -1. On affected systems
this can trigger SIGFPE during arithmetic expansion.

Add an explicit guard before evaluating division or remainder.

Signed-off-by: Muchen Hou <[email protected]>

Merge the overflow check with the zero division check.

Signed-off-by: Herbert Xu <[email protected]>

diff --git a/src/arith_yacc.c b/src/arith_yacc.c
index 1a087c3..b978ef0 100644
--- a/src/arith_yacc.c
+++ b/src/arith_yacc.c
@@ -98,8 +98,8 @@ static intmax_t do_binop(int op, intmax_t a, intmax_t b)
 	default:
 	case ARITH_REM:
 	case ARITH_DIV:
-		if (!b)
-			yyerror("division by zero");
+		if (!b || (a == INTMAX_MIN && b == -1))
+			yyerror("division error");
 		return op == ARITH_REM ? a % b : a / b;
 	case ARITH_MUL:
 		return a * b;
-- 
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt