Re: [LTP] ujson: Fix 4-byte UTF-8 sequence decoding

[linuxtestproject.agent@gmail.com]

Hi Andrea,

On 13 October 2026, Andrea Cervesato wrote:
> ujson: Fix 4-byte UTF-8 sequence decoding

--- [PATCH 7/15] ---

> ujson: reader: Check for signed integer overflow
> diff --git a/libs/ujson/ujson_reader.c b/libs/ujson/ujson_reader.c
> +	if (sign < 0)
> +		res->val_int = -(long)val;

Medium severity: the bound allows LONG_MAX + 1 for negative input, but
-(long)val then negates LONG_MIN, causing signed overflow on both LP64 and
ILP32. Parsing [-9223372036854775808] on LP64 triggers UBSan here. Assign
LONG_MIN directly for that magnitude, or accumulate negative values without
negating LONG_MIN.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp