Skip to content

Undefined behavior when converting NaN to unsigned int in tinyexpr #133

@dreamlike181029-ux

Description

@dreamlike181029-ux

Description

While testing tinyexpr with UndefinedBehaviorSanitizer (UBSan), I found an undefined behavior. Some expressions produce NaN, which is then converted to unsigned int. In C, this is undefined behavior and can lead to unpredictable results.

Environment

OS: Ubuntu 22.04
Compiler: clang 14 (-fsanitize=undefined -g)
Tool: UBSan, fuzzing with libFuzzer

Steps to Reproduce
1.Compile tinyexpr with UBSan:
clang -fsanitize=undefined -g example.c tinyexpr.c -o example
2.Run with an expression that gives NaN, e.g.: (1/0)-(1/0)
3.UBSan reports:
tinyexpr.c:144:52: runtime error: -nan is outside the range of representable values of type 'unsigned int'

Expected Behavior
The program should avoid converting NaN to integers. Possible fixes: check isnan()/isfinite(), keep NaN as float, or return an error.

Impact
Undefined behavior may not crash every time but can cause incorrect results or platform-specific issues.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions