Skip to content

Fix stack overflow in ratpowi32 when power is INT32_MIN - #2512

Open
Amit Dey (amitdey1987) wants to merge 2 commits into
microsoft:mainfrom
amitdey1987:fix/ratpowi32-int-min-overflow
Open

Amit Dey (amitdey1987) wants to merge 2 commits into
microsoft:mainfrom
amitdey1987:fix/ratpowi32-int-min-overflow

Conversation

@amitdey1987

@amitdey1987 Amit Dey (amitdey1987) commented Oct 1, 2026 •

Copy link
Copy Markdown

ratpowi32 handled negative powers by recursing with -power. For INT32_MIN the negation overflows back to INT32_MIN, so the function recursed until the stack was exhausted, crashing on input such as (-1)^(-2^31).

Fixes #2500.

Description of the changes:

Compute the magnitude of the power as uint32_t, run the square-and-multiply loop on that, and invert the result afterwards for negative powers. This also removes the recursion.

How changes were validated:

  • manual testing
  • unit tests updated

ratpowi32 handled negative powers by recursing with -power. For
INT32_MIN the negation overflows back to INT32_MIN, so the function
recursed until the stack was exhausted, crashing on input such as
(-1)^(-2^31).

Compute the magnitude of the power as uint32_t, run the
square-and-multiply loop on that, and invert the result afterwards for
negative powers. This also removes the recursion.

Fixes microsoft#2500

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@amitdey1987

Copy link
Copy Markdown
Author

@microsoft-github-policy-service agree

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Integer overflow in negation in ratpowi32()

1 participant