Skip to content

Conversation

@magnified103
Copy link
Contributor

The following snippet crashes under -fsanitize=undefined when the number of taxa is a multiple of 32.

iqtree3/pda/split.cpp

Lines 179 to 185 in 7cded0c

for (iterator it = begin(), sit = sp.begin(); it != end(); it++, sit++)
{
int num_bits = (it+1 == end()) ? ntaxa % UINT_BITS : UINT_BITS;
UINT it2 = (1 << (num_bits-1)) - 1 + (1 << (num_bits-1)) - (*it);
UINT sit2 = (1 << (num_bits-1)) - 1 + (1 << (num_bits-1)) - (*sit);
res |= (*it) & (*sit);

The fix simply sets num_bits to 32 in that case. It's similar to the fix in iqtree/iqtree2#412. I also manually checked all relevant parts in this file using the same logic.

I think we also need to backport this fix to IQ-TREE 2.

Copy link
Member

@bqminh bqminh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for discovering this!

@bqminh bqminh merged commit 05983b5 into iqtree:master Sep 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants