From b389f010053f4f8db181b9359eb22349583dd643 Mon Sep 17 00:00:00 2001 From: Calvin Rose Date: Sun, 16 Nov 2025 08:14:19 -0600 Subject: [PATCH] Fix undefined behavior (integer overflow) in hash function. If an intermediate hash value was 0xFFFFFFFF and we tried to add 1 as a signed addition, this technically triggers undefined behavior. --- src/core/value.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/core/value.c b/src/core/value.c index b278a1bc..291baeb2 100644 --- a/src/core/value.c +++ b/src/core/value.c @@ -322,7 +322,8 @@ int32_t janet_hash(Janet x) { break; case JANET_TUPLE: hash = janet_tuple_hash(janet_unwrap_tuple(x)); - hash += (janet_tuple_flag(janet_unwrap_tuple(x)) & JANET_TUPLE_FLAG_BRACKETCTOR) ? 1 : 0; + uint32_t inc = (janet_tuple_flag(janet_unwrap_tuple(x)) & JANET_TUPLE_FLAG_BRACKETCTOR) ? 1 : 0; + hash = (int32_t)((uint32_t)hash + inc); /* avoid overflow undefined behavior */ break; case JANET_STRUCT: hash = janet_struct_hash(janet_unwrap_struct(x));