Hello schemers, the fxcopy-bit procedure from (rnrs) is missing some range checks. It can return a non-fixnum:
scheme@(guile-user)> (import (rnrs)) scheme@(guile-user)> (fxcopy-bit 0 (fixnum-width) 1) $1 = 9223372036854775808 It can also crash the guile process, which is somewhat surprising for a fixnum procedure: scheme@(guile-user)> (import (rnrs)) scheme@(guile-user)> (fxcopy-bit 0 100000000000 0) FATAL: memory error in realloc Aborted Here's an alternative error message: scheme@(guile-user)> (import (rnrs)) scheme@(guile-user)> (fxcopy-bit 0 1000000000000 0) gmp: overflow in mpz type Aborted Other implementations of fxcopy-bit usually check that the third argument is 0 or 1, but I'm not sure that is required. There's also a bitwise-copy-bit procedure that is similary affected. Tested with Guile 2.0.9.40-824b-dirty on an amd64 system. Regards, -- Göran Weinholt <go...@weinholt.se> "Mr. Crane, please remember you're not required to answer any of Lt. Tragg's questions. As a matter of fact, don't even discuss the weather with him, he can be very persuasive." -- Perry Mason
pgp1vnahH0KBf.pgp
Description: PGP signature
