Repository navigation
implicit conversion reports from ~FLAG / ~MASK macros (suggest U suffix) #20753
Description
Activity
- Are you seeing the same issue on the latest release, or more preferably, the git master branch? We fix these kind of things regularly when they come up there's a good chance it's already gone (that file has seen 21 updates since 8.16.0).
Are you seeing the same issue on the latest release, or more preferably, the
git master branch? We fix these kind of things regularly when they come up
there's a good chance it's already gone (that file has seen 21 updates since
8.16.0).I checked the latest master. The CURLU_URLDECODE macro is still affected.
If this kind of change is acceptable, may I open a PR to make this kind of mask macros explicitly unsigned?Thanks!
I'm hesitant to modify CURLU_URLDECODE like that since it is public and may very well be used in signed contexts already.
The mentioned uint-spbset.c code seems to already be different in master.
I instead propose a fix without touching the define:
diff --git a/lib/urlapi.c b/lib/urlapi.c index c59f239756..3c84fcba7f 100644 --- a/lib/urlapi.c +++ b/lib/urlapi.c @@ -1553,11 +1553,11 @@ CURLUcode curl_url_get(const CURLU *u, CURLUPart what, switch(what) { case CURLUPART_SCHEME: ptr = u->scheme; ifmissing = CURLUE_NO_SCHEME; - flags &= ~CURLU_URLDECODE; /* never for schemes */ + flags &= ~(unsigned int)CURLU_URLDECODE; /* never for schemes */ if((flags & CURLU_NO_GUESS_SCHEME) && u->guessed_scheme) return CURLUE_NO_SCHEME; break; case CURLUPART_USER: ptr = u->user; @@ -1580,11 +1580,11 @@ CURLUcode curl_url_get(const CURLU *u, CURLUPart what, ifmissing = CURLUE_NO_ZONEID; break; case CURLUPART_PORT: ptr = u->port; ifmissing = CURLUE_NO_PORT; - flags &= ~CURLU_URLDECODE; /* never for port */ + flags &= ~(unsigned int)CURLU_URLDECODE; /* never for port */ if(!ptr && (flags & CURLU_DEFAULT_PORT) && u->scheme) { /* there is no stored port number, but asked to deliver a default one for the scheme */ const struct Curl_scheme *h = Curl_get_scheme(u->scheme); if(h) {
- added 2 commits that reference this issue
on Feb 28, 2026 @vszakats can you understand why @xmoezzz gets undefined sanitizer hits on these when our CI jobs don't?
I was wondering about it too. I haven't taken a close look at these jobs before.
Will do it now.@xmoezzz If you don't mind posting the compiler command-line that successfully triggered
the warnings for your, it'd be helpful to see it, and compare with curl's CI.@vszakats can you understand why @xmoezzz gets undefined sanitizer hits on these when our CI jobs don't?
I was wondering about it too. I haven't taken a close look at these jobs before. Will do it now.
@xmoezzz If you don't mind posting the compiler command-line that successfully triggered the warnings for your, it'd be helpful to see it, and compare with curl's CI.
I think
-fsanitize=undefined,integer,boundscan reproduce this report.@xmoezzz Thank you. I managed to trigger it with this option in CI, at least for
urlapi.cline 1558.integerwas the missing bit, I think, but still need to reduce changes to tell for sure. Unfortunatelyintegermakes tests execute very slow, reaching into test 0350 in about 18 minutes. May take an hour or 2 to run them all: https://github.com/curl/curl/actions/runs/22606123719/job/65498425580?pr=20785#step:48:144/home/runner/work/curl/curl/lib/urlapi.c:1558:14: runtime error: implicit conversion from type 'int' of value -65 (32-bit, signed) to type 'unsigned int' changed the value to 4294967231 (32-bit, unsigned) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/runner/work/curl/curl/lib/urlapi.c:1558:14I'll continue experimenting.
- added a commit that references this issue
on Mar 3, 2026 - added a commit that references this issue
on Mar 3, 2026 - added a commit that references this issue
on Jun 3, 2026
I did this
Hi,
I'm using
curl 8.16.0, when building with UBSan I see the following implicit conversion reports.call stacks
I expected the following
I guess we can make the macro constants unsigned (adding U) to suppress these reports without changing bitmask semantics, e.g.:
I also ran ast-grep to locate similar sites:
This found additional
&= ~MACROusages; would it be acceptable to address similar cases by making the relevant mask macros unsigned viaUsuffixes?related PR
PR #11814
curl/libcurl version
curl 8.16.0
operating system
Fedora Linux 42