<HTML><BODY><div class="cl-pjab9f7bwj"><div>Hi, Sergey! Thanks for the patch!</div><div> </div><div>LGTM<br><br> </div><div data-signature-widget="container"><div data-signature-widget="content"><div>--<br>Best regards,</div><div>Evgeniy Temirgaleev</div></div></div><br><div class="mail-quote-collapse"><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px"><span>From: Sergey Bronnikov via Tarantool-patches <<a href="mailto:tarantool-patches@dev.tarantool.org">tarantool-patches@dev.tarantool.org</a>><br>To: Sergey Kaplun <<a href="mailto:skaplun@tarantool.org">skaplun@tarantool.org</a>>, Sergey Bronnikov <<a href="mailto:estetus@gmail.com">estetus@gmail.com</a>><br>Cc:<a href="mailto:tarantool-patches@dev.tarantool.org">tarantool-patches@dev.tarantool.org</a><br>Date: Tuesday, July 28, 2026 1:06 PM +03:00</span><br> <div><div id=""><div class="cl-4nksro1pqd"><div class="js-helper_mr_css_attr js-readmsg-msg_mr_css_attr"><div id="style_17852331770607249770_mr_css_attr"><div id="style_17852331770607249770_BODY_mr_css_attr"><p>Hello,</p><p>Thanks for review! See my comments.</p><p>Fixes are applied and the branch was force-pushed.</p><p>Sergey</p><div class="moz-cite-prefix_mr_css_attr">On 7/27/26 10:39, Sergey Kaplun via Tarantool-patches wrote:</div><blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr">Hi, Sergey!
Thanks for the patch!
Please consider my comments below.
On 24.07.26, Sergey Bronnikov wrote:
</pre><blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr">From: Mike Pall <mike>
Reported by Sergey Bronnikov.
(cherry picked from commit c3b379bf50c8819c61daa3afd9f21d9ec5708bd5)
</pre></blockquote><pre class="moz-quote-pre_mr_css_attr">Side note: We may mention that this is a follow-up for the commit
78f4de4d7d0c410eeaf75cec5bb178fdb7db1452 ("Avoid negation of signed
integers in C that may hold INT*_MIN.").</pre></blockquote><p>Updated, updated commit message is below:</p><p> FFI: Prevent sanitizer warning in carith_ptr().<br> <br> Reported by Sergey Bronnikov.<br> <br> (cherry picked from commit c3b379bf50c8819c61daa3afd9f21d9ec5708bd5)<br> <br> The Undefined Behaviour Sanitizer [1] produce a warning about<br> signed integer overflow in the function carith_ptr(), when idx<br> equals INT_MIN in the expression idx = -idx. In practice,<br> negating -2147483648 wraps back to itself instead of producing the<br> correct positive value, leading to incorrect pointer arithmetic in<br> carith_ptr() for MM_sub (pointer subtraction). The patch fixes<br> that by converting idx to unsigned (uintptr_t), computes two's<br> complement negation via bitwise negation + 1 (safe from overflow<br> in unsigned arithmetic), and casts back to ptrdiff_t. This avoids<br> signed overflow entirely and correctly negates even the INT_MIN<br> edge case.<br> <br> The patch follows up the commit 78f4de4d7d0c410eeaf75cec5bb178fdb7db1452<br> ("Avoid negation of signed integers in C that may hold INT*_MIN.").<br> <br> [1]: <a href="https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html" class="moz-txt-link-freetext_mr_css_attr">https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html</a><br> <br> Sergey Bronnikov:<br> * added the description and the test for the problem<br> <br> Part of tarantool/tarantool#12480</p><p> </p><blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr">Feel free to ignore.
</pre><blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr">The Undefined Behaviour Sanitizer [1] produce a warning about
</pre></blockquote><pre class="moz-quote-pre_mr_css_attr">Typo: s/produce/produces/
</pre></blockquote><p>Fixed, thanks.</p><blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr"> </pre><blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr">signed integer overflow in the function carith_ptr(), when idx
equals INT_MIN in the expression idx = -idx. In practice,
negating -2147483648 wraps back to itself instead of producing the
</pre></blockquote><pre class="moz-quote-pre_mr_css_attr">It's actually -9223372036854775808 or -0x8000000000000000 for 64-bit
architecture. Let's use hexademic notation (or just the `INT_MIN`)
instead of this number.</pre></blockquote>replaced the number with INT_MIN<blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr"> </pre><blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr">correct positive value, leading to incorrect pointer arithmetic in
carith_ptr() for MM_sub (pointer subtraction). The patch fixes
that by converting idx to unsigned (uintptr_t), computes two's
complement negation via bitwise negation + 1 (safe from overflow
in unsigned arithmetic), and casts back to ptrdiff_t. This avoids
signed overflow entirely and correctly negates even the INT_MIN
edge case.
[1]: <a href="https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html" class="moz-txt-link-freetext_mr_css_attr">https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html</a>
Sergey Bronnikov:
* added the description and the test for the problem
Part of tarantool/tarantool#12480
</pre></blockquote><pre class="moz-quote-pre_mr_css_attr">Typo: s/12480/12880/</pre></blockquote> Fixed, thanks!<blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr"> </pre><blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr">---
Branch: <a href="https://github.com/tarantool/luajit/tree/ligurio/lj-1459-ub-carith_ptr" class="moz-txt-link-freetext_mr_css_attr">https://github.com/tarantool/luajit/tree/ligurio/lj-1459-ub-carith_ptr</a>
Related issues:
- <a href="https://github.com/LuaJIT/LuaJIT/issues/1459" class="moz-txt-link-freetext_mr_css_attr">https://github.com/LuaJIT/LuaJIT/issues/1459</a>
- <a href="https://github.com/tarantool/tarantool/issues/12880" class="moz-txt-link-freetext_mr_css_attr">https://github.com/tarantool/tarantool/issues/12880</a>
src/lj_carith.c | 2 +-
.../lj-1459-subtraction-carith.test.lua | 16 ++++++++++++++++
2 files changed, 17 insertions(+), 1 deletion(-)
create mode 100644 test/tarantool-tests/lj-1459-subtraction-carith.test.lua
diff --git a/src/lj_carith.c b/src/lj_carith.c
index eb56d552..e971bfc2 100644
--- a/src/lj_carith.c
+++ b/src/lj_carith.c
</pre></blockquote><pre class="moz-quote-pre_mr_css_attr"><snipped>
</pre><blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr">diff --git a/test/tarantool-tests/lj-1459-subtraction-carith.test.lua b/test/tarantool-tests/lj-1459-subtraction-carith.test.lua
new file mode 100644
index 00000000..df401a56
--- /dev/null
+++ b/test/tarantool-tests/lj-1459-subtraction-carith.test.lua
@@ -0,0 +1,16 @@
+local tap = require('tap')
+
+-- The test file to demonstrate UBSan warning in carith_ptr().
</pre></blockquote><pre class="moz-quote-pre_mr_css_attr">Typo: s/UBSan/the UBSan/
Minor: s/carith_ptr()/`carith_ptr()`/</pre></blockquote><p>Updated:</p><p>--- a/test/tarantool-tests/lj-1459-subtraction-carith.test.lua<br>+++ b/test/tarantool-tests/lj-1459-subtraction-carith.test.lua<br>@@ -1,6 +1,7 @@<br> local tap = require('tap')<br> <br>--- The test file to demonstrate UBSan warning in carith_ptr().<br>+-- The test file to demonstrate the UBSan warning in<br>+-- `carith_ptr()`.<br> -- See also: <a href="https://github.com/LuaJIT/LuaJIT/issues/1459" class="moz-txt-link-freetext_mr_css_attr">https://github.com/LuaJIT/LuaJIT/issues/1459</a>.<br> local test = tap.test('lj-1459-subtraction-carith')<br> <br> </p><blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr"> </pre><blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr">+-- See also: <a href="https://github.com/LuaJIT/LuaJIT/issues/1459" class="moz-txt-link-freetext_mr_css_attr">https://github.com/LuaJIT/LuaJIT/issues/1459</a>.
+local test = tap.test('lj-1459-subtraction-carith')
+
+test:plan(2)
+
+local func = load('_ = nil - 0LL%0')
</pre></blockquote><pre class="moz-quote-pre_mr_css_attr">Minor: Let's use loadstring instead (I know that they are literally the
same function in LuaJIT, but it's semantically better to use it for
loading strings, while `load()` is used for generators).
For Lua 5.1 they are not the same:
| lua5.1 -e 'load"print(1)"()'
| lua5.1: (command line):1: bad argument #1 to 'load' (function expected, got string)
The `loadstring()` has been deprecated in Lua5.2.
This `0LL%0` looks weird. Let's just use the resulting
`-0x8000000000000000LL` instead.
Also, please add the comment that `nil` as the first operand of
subtraction is required, since it is required to trigger metamethod
invocation. It successfully passes the argument check since it may be
considered as NULL ptr for other metamethods.</pre></blockquote><p>Updated:</p><p>--- a/test/tarantool-tests/lj-1459-subtraction-carith.test.lua<br>+++ b/test/tarantool-tests/lj-1459-subtraction-carith.test.lua<br>@@ -7,7 +7,11 @@ local test = tap.test('lj-1459-subtraction-carith')<br> <br> <a class="moz-txt-link-freetext_mr_css_attr">test:plan(2)</a><br> <br>-local func = loadstring('_ = nil - 0LL%0')<br>+-- The `nil` as the first operand of subtraction is required,<br>+-- since it is required to trigger metamethod invocation.<br>+-- It successfully passes the argument check since it may be<br>+-- considered as NULL ptr for other metamethods.<br>+local func = loadstring('_ = nil - 0x8000000000000000LL')<br> local res, err = pcall(func)<br> <br> <a class="moz-txt-link-freetext_mr_css_attr">test:is(res</a>, false, 'correct result')<br> </p><blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr"> </pre><blockquote type="cite"><pre class="moz-quote-pre_mr_css_attr">+local res, err = pcall(func)
+
+test:is(res, false, 'correct result')
+local error_msg = "attempt to perform arithmetic on 'nil' and 'int64_t'"
+test:ok(<a class="moz-txt-link-freetext_mr_css_attr">err:match(error_msg)</a>, 'error on subtraction')
+
+test:done(true)
--
2.43.0
</pre></blockquote><pre class="moz-quote-pre_mr_css_attr"> </pre></blockquote></div></div></div></div></div></div></blockquote></div></div></BODY></HTML>