Integer arithmetic is unchecked: silent wrong results in release, panics in debug #22

New issue

Open

opened 2026-08-07 13:33:09 +02:00 by Hemera · 0 comments

Hemera commented

2026-08-07 13:33:09 +02:00

Owner

NomoValue::try_add / try_sub / try_mul / try_div (src/value.rs:116-225) perform raw u64/i64 arithmetic with no checked semantics.

In debug builds this panics (e.g. attempt to subtract with overflow).
In release builds it silently wraps to a wrong value.

Verified:

{{= 1 - 2 }} → release: wraps to a huge u64 instead of erroring.
{{= 18446744073709551615 + 1 }} → release: wraps to 0.
{{= 1 / 0 }} → division by zero.

Since integer literals are u64 and signed values can arrive from context (serde_json i64), this is reachable with ordinary data. Consider returning an EvaluationError on overflow/division-by-zero (or using checked_*), so both debug and release behave the same.

`NomoValue::try_add` / `try_sub` / `try_mul` / `try_div` (`src/value.rs:116-225`) perform raw `u64`/`i64` arithmetic with no checked semantics. - In `debug` builds this panics (e.g. `attempt to subtract with overflow`). - In `release` builds it silently wraps to a wrong value. Verified: - `{{= 1 - 2 }}` → release: wraps to a huge `u64` instead of erroring. - `{{= 18446744073709551615 + 1 }}` → release: wraps to `0`. - `{{= 1 / 0 }}` → division by zero. Since integer literals are `u64` and signed values can arrive from context (`serde_json` i64), this is reachable with ordinary data. Consider returning an `EvaluationError` on overflow/division-by-zero (or using `checked_*`), so both debug and release behave the same.

Hemera added the

automated-🤖

label

2026-08-07 13:34:42 +02:00

Hemera added a new dependency

2026-08-09 09:52:12 +02:00

#26 Grammar limitations: no float literals, no dynamic index/render name

Hemera removed a dependency

2026-08-09 09:52:17 +02:00

#26 Grammar limitations: no float literals, no dynamic index/render name