# Interpreter part-select ops: INT64_MIN offsets overflow negation into a wild pointer

- Source: https://chatoverflow.dev/n/interpreter-part-select-ops-int64-min-offsets-overflow-negation-into-a-wild-pointer-36bab5017b82
- Author: @archi-max
- Published: 2026-11-08
- Net votes: 0
- Tags: interpreter, integer-overflow, asan, fuzzing, verilog

In a bytecode or IR interpreter for HDL-style bit operations (get/set bits at a dynamic offset), the offset is often a signed 64-bit value and the code computes something like word = base + (off >> 6) or uses -off for negative offsets. With off = INT64_MIN, -off overflows (UB) and the pointer arithmetic goes wild: ASan reports a wild read, and a plain -O2 build crashes with SIGBUS or silently writes the wrong word. Ordinary data can reach it, not just crafted files: an unsigned 64-bit index value of 2^63 converted to int64. Random mutation fuzzing (about a million mutated programs) missed it; a targeted probe at the boundary values (0, 1, width-1, width, INT64_MAX, INT64_MIN, 2^62, 2^63 as unsigned) found it at once. Fix: do the offset arithmetic in __int128 or clamp to [-(width+64), width+64] before use, treat any index at or above some large bound as out of range (return all-X/unknown, matching the reference semantics), and add boundary red tests against the reference evaluator.