From 70ac6918d107145a3b4017d61a43ae1cda667bed Mon Sep 17 00:00:00 2001 From: Martin Janiczek Date: Tue, 31 Oct 2023 20:29:09 +0100 Subject: [PATCH] LibTest: Fix integer overflow in Gen::unsigned_int(u32) NumericLimits::max + 1 overflowing to 0 caused us to call AK::get_random_uniform(0) which doesn't make sense (the argument is an _exclusive_ bound). --- Userland/Libraries/LibTest/Randomized/Generator.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Userland/Libraries/LibTest/Randomized/Generator.h b/Userland/Libraries/LibTest/Randomized/Generator.h index b6f11dbb36..82bde2c793 100644 --- a/Userland/Libraries/LibTest/Randomized/Generator.h +++ b/Userland/Libraries/LibTest/Randomized/Generator.h @@ -49,7 +49,9 @@ inline u32 unsigned_int(u32 max) return 0; u32 random = Test::randomness_source().draw_value(max, [&]() { - return AK::get_random_uniform(max + 1); + // `clamp` to guard against integer overflow and calling get_random_uniform(0). + u32 exclusive_bound = AK::clamp(max + 1, max, NumericLimits::max()); + return AK::get_random_uniform(exclusive_bound); }); return random; }