From 33c007a1ac22d3aef3655e250ffbf4f489b28282 Mon Sep 17 00:00:00 2001 From: EylonKrause Date: Wed, 1 Jul 2026 22:46:03 +0300 Subject: [PATCH] ndk_compat: bound the shift in set_cpu_mask_bit parse_cpu_mask's single-index path passes the parsed cpu index straight to set_cpu_mask_bit, which did `*cpu_mask |= 1UL << index` with no bound. cpu_mask is a 32-bit mask, so an index >= 32 truncates, and an index >= the width of the shifted type (a lone core index >= 64 on a many-core machine, or a crafted topology line) is undefined behavior. The range path already guards `i < 32`; apply the same bound in the helper so both callers are safe, and shift a uint32_t to match the mask type. --- ndk_compat/cpu-features.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ndk_compat/cpu-features.c b/ndk_compat/cpu-features.c index 27ff7bbd..c7d11be9 100644 --- a/ndk_compat/cpu-features.c +++ b/ndk_compat/cpu-features.c @@ -27,7 +27,11 @@ static uint32_t g_cpuIdArm; #endif static void set_cpu_mask_bit(uint32_t index, uint32_t* cpu_mask) { - *cpu_mask |= 1UL << index; + // cpu_mask is a 32-bit mask; a larger index would shift past its width + // (shifting by >= the operand width is undefined behavior). The range path + // in parse_cpu_mask bounds indices the same way. + if (index >= 32) return; + *cpu_mask |= (uint32_t)1 << index; } // Examples of valid inputs: "31", "4-31"