Tcl Source Code

Signed integer overflow (undefined behavior) occurs in TclParseNumber() (tclStrToD.c) for inputs equal to LONG_MIN or LLONG_MIN. UBSan (-fsanitize=signed-integer-overflow) errors for 32-bit long and 64-bit long long:

% set a 0; incr a -0o1000000000000000000000
tcl/generic/tclStrToD.c:1315:9: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself
-9223372036854775808
% set b 0; incr b -0o20000000000
tcl/generic/tclStrToD.c:1330:5: runtime error: negation of -2147483648 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
-2147483648
% set c 0; incr c -0x8000000000000000
tcl/generic/tclStrToD.c:1362:9: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself
-9223372036854775808
% set d 0; incr d -0x80000000
tcl/generic/tclStrToD.c:1377:5: runtime error: negation of -2147483648 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
-2147483648

Negating before casting avoids this. However it may also be preferable to negate by subtracting from 0 (binary minus) to avoid compiler warnings for unary minus with unsigned operand (e.g. MSVC /W2 warning C4146). See attached patch.

Fixed [c5cded8dc704a0cf|here]

Thanks for the report!