From a75a1ab224dfc16bbf31ecfcbe7904eb41c5464b Mon Sep 17 00:00:00 2001 From: Nitjsefnie Date: Thu, 23 Jul 2026 16:09:59 +0200 Subject: [PATCH] fix(vm): range-check magnitude before the long long cast in value_to_string (#695) value_to_string's VAL_NUM case tested `n == (long long)n && fabs(n) < 2^53`, evaluating the `(long long)n` cast (the left conjunct) before the magnitude guard. For |n| >= 2^63 that float-to-long-long conversion is undefined behavior (float-cast-overflow, flagged by UBSan/CodeQL). Swap the conjuncts so the range check short-circuits and guards the cast; behavior for in-range values is unchanged. Co-Authored-By: Claude Opus 4.8 --- src/eigenscript.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/eigenscript.c b/src/eigenscript.c index 610e6e8..8ec8fea 100644 --- a/src/eigenscript.c +++ b/src/eigenscript.c @@ -1458,7 +1458,7 @@ char* value_to_string(Value *v) { double n = v->data.num; /* Exact integers up to 2^53 (the largest integer all doubles * represent exactly) print without a decimal point or exponent. */ - if (n == (long long)n && fabs(n) < 9007199254740992.0) { + if (fabs(n) < 9007199254740992.0 && n == (long long)n) { snprintf(buf, sizeof(buf), "%lld", (long long)n); } else { /* Shortest representation that round-trips: try 15..17