From 7f7a7b6d6a2a370f8c35bd4f96b21f7ba77abdcc Mon Sep 17 00:00:00 2001 From: Andreas Suter Date: Sat, 6 Jun 2026 15:02:17 +0200 Subject: [PATCH] libCuba: guard memcpy in SobolIni against negative length GCC's -Wstringop-overflow flagged the memcpy in SobolIni() with a bound of (size_t)(-4): on the (in practice unreachable) path where the Sobol generator polynomial 'powers' is 0, the bit-count loop leaves inibits at its initial -1, so inibits*sizeof underflows. The generator-polynomial table always has a non-zero first column, so this never happens at run time, but the compiler cannot prove it. Guard the copy with 'if (inibits > 0)', which silences the false-positive warning and hardens the edge case without changing behaviour for valid input. Co-Authored-By: Claude Opus 4.8 --- src/external/libCuba/src/common/Random.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/external/libCuba/src/common/Random.c b/src/external/libCuba/src/common/Random.c index 6d606157..d1720c5d 100644 --- a/src/external/libCuba/src/common/Random.c +++ b/src/external/libCuba/src/common/Random.c @@ -102,7 +102,8 @@ static inline void SobolIni(This *t) int inibits = -1, bit; for( j = powers; j; j >>= 1 ) ++inibits; - memcpy(pv, pini, inibits*sizeof *pini); + if( inibits > 0 ) + memcpy(pv, pini, inibits*sizeof *pini); pini += 8; for( bit = inibits; bit <= nbits; ++bit ) {