Hi, Evgeniy,

On 6/11/26 14:44, Evgeniy Temirgaleev via Tarantool-patches wrote:
>
> Hi, Sergey! Thanks for the patch!
> Please, see my comment.
> --
> Best regards,
> Evgeniy Temirgaleev
>
>     From: Sergey Bronnikov <estetus@gmail.com>
>     To: tarantool-patches@dev.tarantool.org, Sergey Kaplun
>     <skaplun@tarantool.org>,e.temirgaleev@tarantool.org
>     Date: Friday, June 5, 2026 6:19 PM +03:00
>     From: Mike Pall <mike>
>
>     Reported by Sergey Bronnikov.
>
>     (cherry picked from commit 86d414f5cae062b06998ec66b0696a47d4f6a0f0)
>
>     The function `lj_cf_os_time()` calculates `tm_mon` and `tm_year`
>     values using `get_field()` and when the helper function returns
>     a negative value the resulted values may be negative as well. This
>     is an undefined behaviour (signed integer overflow). The patch fixes
>     that by adding a cast for the resulted value to returned by
>     `get_field()`.
>
>     Sergey Bronnikov:
>     * added the description and the test for the problem
>
>     Part of tarantool/tarantool#12480
>     ---
>
>     Branch:
>     https://github.com/tarantool/luajit/tree/ligurio/lj-1454-ub-os-time
>
>     Related issues:
>
>     * https://github.com/tarantool/tarantool/issues/12480
>     * https://github.com/LuaJIT/LuaJIT/issues/1454
>
>     src/lib_os.c | 4 ++--
>     test/tarantool-tests/lj-1454-os-time.test.lua | 19 +++++++++++++++++++
>     2 files changed, 21 insertions(+), 2 deletions(-)
>     create mode 100644 test/tarantool-tests/lj-1454-os-time.test.lua
>
>     diff --git a/src/lib_os.c b/src/lib_os.c
>     index ffbc3fdc..0feb0d47 100644
>     --- a/src/lib_os.c
>     +++ b/src/lib_os.c
>     @@ -239,8 +239,8 @@ LJLIB_CF(os_time)
>     ts.tm_min = getfield(L, "min", 0);
>     ts.tm_hour = getfield(L, "hour", 12);
>     ts.tm_mday = getfield(L, "day", -1);
>     - ts.tm_mon = getfield(L, "month", -1) - 1;
>     - ts.tm_year = getfield(L, "year", -1) - 1900;
>     + ts.tm_mon = (int)((unsigned int)getfield(L, "month", -1) - 1u);
>     + ts.tm_year = (int)((unsigned int)getfield(L, "year", -1) - 1900u);
>
> We just suppress signed integer-overflow warning implicitly by casting 
> (and get an unsigned integer-overflow warning instead —
> try `luajit -e "os.time({ day = 0, month = 0, year = 0 })"` with clang 
> and -fsanitize=integer).

Thanks for highlighting this!

I've reported this to upstream [1].

1. https://github.com/LuaJIT/LuaJIT/issues/1454#issuecomment-6683039935

<snipped>