Re: [v2 PATCH] arith: Fix CVE-2026-31323 INTMAX_MIN / -1 overflow

Herbert Xu wrote in
 <[email protected]>:
 |On Wed, Apr 08, 2026 at 04:47:10PM +0800, =E9=83=BD=E8=A7=89=E5=BE=97=E5=
=B0=B1=E5=88=B0=E5=AE=B6 wrote:
 |> Division and remainder currently guard against division by zero, but not
 |> against the signed overflow case INTMAX_MIN / -1. On affected systems
 |> this can trigger SIGFPE during arithmetic expansion.
 ...
 |Division and remainder currently guard against division by zero, but not
 |against the signed overflow case INTMAX_MIN / -1. On affected systems
 |this can trigger SIGFPE during arithmetic expansion.
 |
 |Add an explicit guard before evaluating division or remainder.
 ...
 |diff --git a/src/arith_yacc.c b/src/arith_yacc.c
 |index 1a087c3..b978ef0 100644
 |--- a/src/arith_yacc.c
 |+++ b/src/arith_yacc.c
 |@@ -98,8 +98,8 @@ static intmax_t do_binop(int op, intmax_t a, intmax_t b)
 |  default:
 |  case ARITH_REM:
 |  case ARITH_DIV:
 |-             if (!b)
 |-                     yyerror("division by zero");
 |+             if (!b || (a =3D=3D INTMAX_MIN && b =3D=3D -1))
 |+                     yyerror("division error");

Sorry for pissing around, but i said

  Btw for div/mod i would take note on

        /* For /,%, avoid lvh=3DS64_MIN, rhv=3D-1:
         * CHANGES, bash 4.3 [ac50fbac377e32b98d2de396f016ea81e8ee9961]:
         *   Fixed a bug that caused floating-point exceptions and
         *   overflow errors for the / and % arithmetic operators when
         *   using INTMAX_MIN and -1. */
  ...

in 20250731190752.qd9B7w_u@steffen%sdaoden.eu on 2025-07-31, just
to note it.
(Ok i read my "gah just cast and do it" for undefined
behaviour on left shifts that comes earlier with suspicion myself,
especially since i followed Harald van Dijk's excellent approach
on right shift plus now limit anything via &=3D63, after that
lengthy thread that saw me actually searching around hardware
descriptions, which got me .. i think two .. which really do not
mask down themselves.)

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)