

<HTML><BODY><div class="cl-609cjesszh"><div class="js-helper_mr_css_attr js-readmsg-msg_mr_css_attr"><div id="style_17811786211395121262_mr_css_attr"><div id="style_17811786211395121262_BODY_mr_css_attr"><div class="cl-9gf4qk5j5x_mr_css_attr"><div>Hi, Sergey!</div><div> </div><div>It’s an addition for my previous letter. I am sorry, but the some part of the quote was missed in it.</div><div> </div><div>My single comment is about these lines:</div><div> </div><div>> - ts.tm_mon = getfield(L, "month", -1) - 1;<br>> - ts.tm_year = getfield(L, "year", -1) - 1900;<br>> + ts.tm_mon = (int)((unsigned int)getfield(L, "month", -1) - 1u);<br>> + ts.tm_year = (int)((unsigned int)getfield(L, "year", -1) - 1900u);</div><div> </div><div><please, see the comment text in the first letter><br> </div><div data-signature-widget="container"><div data-signature-widget="content"><div>--<br>Best regards,</div><div>Evgeniy Temirgaleev</div></div></div> <div class="mail-quote-collapse_mr_css_attr"><div class="mail-quote-collapse"><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px"><span><span>From: Sergey Bronnikov <<a href="mailto:estetus@gmail.com">estetus@gmail.com</a>><br>To: tarantool-patches@dev.tarantool.org, Sergey Kaplun <<a href="mailto:skaplun@tarantool.org">skaplun@tarantool.org</a>>,<a href="mailto:e.temirgaleev@tarantool.org">e.temirgaleev@tarantool.org</a><br>Date: Friday, June 5, 2026 6:19 PM +03:00</span></span> <div> <div><div id=""><div class="cl-c2z34tlyfx_mr_css_attr"><div class="js-helper_mr_css_attr js-readmsg-msg_mr_css_attr"><div id="style_17806727590583898164_mr_css_attr"><div id="style_17806727590583898164_BODY_mr_css_attr">From: Mike Pall <mike><br><br>Reported by Sergey Bronnikov.<br><br>(cherry picked from commit 86d414f5cae062b06998ec66b0696a47d4f6a0f0)<br><br>The function `lj_cf_os_time()` calculates `tm_mon` and `tm_year`<br>values using `get_field()` and when the helper function returns<br>a negative value the resulted values may be negative as well. This<br>is an undefined behaviour (signed integer overflow). The patch fixes<br>that by adding a cast for the resulted value to returned by<br>`get_field()`.<br><br>Sergey Bronnikov:<br>* added the description and the test for the problem<br><br>Part of tarantool/tarantool#12480<br>---<br><br>Branch: <a href="https://github.com/tarantool/luajit/tree/ligurio/lj-1454-ub-os-time">https://github.com/tarantool/luajit/tree/ligurio/lj-1454-ub-os-time</a><br><br>Related issues:<br><br>* <a href="https://github.com/tarantool/tarantool/issues/12480">https://github.com/tarantool/tarantool/issues/12480</a><br>* <a href="https://github.com/LuaJIT/LuaJIT/issues/1454">https://github.com/LuaJIT/LuaJIT/issues/1454</a><br><br>src/lib_os.c | 4 ++--<br>test/tarantool-tests/lj-1454-os-time.test.lua | 19 +++++++++++++++++++<br>2 files changed, 21 insertions(+), 2 deletions(-)<br>create mode 100644 test/tarantool-tests/lj-1454-os-time.test.lua<br><br>diff --git a/src/lib_os.c b/src/lib_os.c<br>index ffbc3fdc..0feb0d47 100644<br>--- a/src/lib_os.c<br>+++ b/src/lib_os.c<br>@@ -239,8 +239,8 @@ LJLIB_CF(os_time)<br>ts.tm_min = getfield(L, "min", 0);<br>ts.tm_hour = getfield(L, "hour", 12);<br>ts.tm_mday = getfield(L, "day", -1);<br>- ts.tm_mon = getfield(L, "month", -1) - 1;<br>- ts.tm_year = getfield(L, "year", -1) - 1900;<br>+ ts.tm_mon = (int)((unsigned int)getfield(L, "month", -1) - 1u);<br>+ ts.tm_year = (int)((unsigned int)getfield(L, "year", -1) - 1900u);<br>ts.tm_isdst = getboolfield(L, "isdst");<br>t = mktime(&ts);<br>}<br>diff --git a/test/tarantool-tests/lj-1454-os-time.test.lua b/test/tarantool-tests/lj-1454-os-time.test.lua<br>new file mode 100644<br>index 00000000..2a48750c<br>--- /dev/null<br>+++ b/test/tarantool-tests/lj-1454-os-time.test.lua<br>@@ -0,0 +1,19 @@<br>+local tap = require('tap')<br>+<br>+-- The test file to demonstrate UBSan warning for `os.time()` with<br>+-- a huge indices value for month and/or year.<br>+-- See also: <a href="https://github.com/LuaJIT/LuaJIT/issues/1454">https://github.com/LuaJIT/LuaJIT/issues/1454</a>.<br>+local test = tap.test('lj-1454-os-time')<br>+<br>+test:plan(1)<br>+<br>+local INT_MIN = -2 ^ 31<br>+<br>+local cur_time = os.time({<br>+ day = 1,<br>+ month = INT_MIN,<br>+ year = INT_MIN,<br>+})<br>+test:is(cur_time, nil, 'os.time() with INT_MIN')<br>+<br>+test:done(true)<br>--<br>2.43.0</div></div></div></div></div></div></div></blockquote></div></div></div></div></div></div></div></BODY></HTML>