Caption numeric setters cast negative floats to unsigned int (UBSan) #309

New issue

Closed

opened 2026-04-11 21:21:59 +00:00 by john · 0 comments

john commented

2026-04-11 21:21:59 +00:00

Owner

Found by: fuzz_property_types target (W5)

Summary

src/UICaption.cpp:216 casts a raw float to unsigned int without clamping or range-checking. Feeding a negative value (e.g. -992.065) into one of the Caption numeric setters (outline, font_size, or z_index) produces undefined behavior. UBSan reports:

runtime error: -992.065 is outside the range of representable values of type 'unsigned int'

Reproduction

Crash input preserved at:

tests/fuzz/crashes/property_types-crash-1f7141d732736d04b99d20261abd766194246ea6

Root Cause

The setter accepts a Python float and casts it directly:

// src/UICaption.cpp:216 (approx)
self->data->setSomething((unsigned int)value);

Any value < 0 or > UINT_MAX is UB on the cast.

Suggested Fix

Clamp to the valid range before the cast, e.g.:

if (value < 0.0f) value = 0.0f;
self->data->setSomething((unsigned int)value);

or change the underlying storage to a signed type if negatives are meaningful (they almost certainly aren't for outline/font_size).

Scope

Audit the other numeric setters on UICaption (and likely other UI types) for the same pattern while we're in there.

**Found by:** `fuzz_property_types` target (W5) ## Summary `src/UICaption.cpp:216` casts a raw `float` to `unsigned int` without clamping or range-checking. Feeding a negative value (e.g. `-992.065`) into one of the Caption numeric setters (`outline`, `font_size`, or `z_index`) produces undefined behavior. UBSan reports: ``` runtime error: -992.065 is outside the range of representable values of type 'unsigned int' ``` ## Reproduction Crash input preserved at: ``` tests/fuzz/crashes/property_types-crash-1f7141d732736d04b99d20261abd766194246ea6 ``` ## Root Cause The setter accepts a Python float and casts it directly: ```cpp // src/UICaption.cpp:216 (approx) self->data->setSomething((unsigned int)value); ``` Any value `< 0` or `> UINT_MAX` is UB on the cast. ## Suggested Fix Clamp to the valid range before the cast, e.g.: ```cpp if (value < 0.0f) value = 0.0f; self->data->setSomething((unsigned int)value); ``` or change the underlying storage to a signed type if negatives are meaningful (they almost certainly aren't for `outline`/`font_size`). ## Scope Audit the other numeric setters on `UICaption` (and likely other UI types) for the same pattern while we're in there.