ksh93 / ksh

ksh 93u+m: KornShell lives! | Latest release: https://github.com/ksh93/ksh/releases
Eclipse Public License 2.0
192 stars 32 forks source link

Infinite loop when evaluating ((-2**63/-1)) #789

Open oliwer opened 1 month ago

oliwer commented 1 month ago

Using Korn Shell Version AJM 93u+m/1.0.8 2024-01-01 on Linux amd64, the following command causes ksh to run into an infinite loop. I had to kill -9 it:

echo $((-2**63/-1))

I ran a quick gdb, and it seems this line is the culprit: https://github.com/ksh93/ksh/blob/7170ac01c4f4603586661761ba685d2d3c2d69bc/src/cmd/ksh93/sh/streval.c#L359

The variable sp[-1] holds a negative long double (-9223372036854775808) which we are casting to an unsigned long. Looks like a similar issue to https://github.com/ksh93/ksh/issues/770

McDutchie commented 1 month ago

I don't have access to Linux x86_64 right now, but on FreeBSD x86_64, the symptom is:

$ arch/freebsd13.i386-64/bin/ksh -c 'echo $((-2**63/-1))'
Floating exception(coredump)

Yes, looks like a workaround similar to the one that fixed #770 might work — though the real problem here is #771, which is not getting fixed anytime soon I'm afraid :(