Fixed several instances of UB in floating point arithmetic, as pointed out in Issue microsoft#732. Thank you @Wowblk.

kimlaine · kimlaine · commit 15fd4e356a3a · 2026-04-25T00:23:11.000-07:00
diff --git a/CHANGES.md b/CHANGES.md
@@ -4,7 +4,9 @@
 
 - Merged [(PR #734)](https://github.com/microsoft/SEAL/pull/734): Fixed `IterTuple` constructors that returned references to local temporaries.
 - Merged [(PR #738)](https://github.com/microsoft/SEAL/pull/738): Fixed out-of-bounds read in `Serialization_IsCompatibleVersion` and `Serialization_IsValidHeader` (C API).
+- Fixed undefined behavior in CKKS encoding reported in [(issue #732)](https://github.com/microsoft/SEAL/issues/732) by [Wowblk](https://github.com/Wowblk), and other instances of a similar broken pattern.
 - Bumped .NET target framework from `net8.0` to `net10.0`.
+- Updated dependency versions: Google Benchmark to 1.9.5, GoogleTest to 1.17.0, MSGSL to 4.2.1, zlib to 1.3.2.
 - Added `cmake/ios_xcframework.cmake` and a CI artifact that produces `libseal-<ver>.xcframework` and `libsealc-<ver>.xcframework` in one command.
 - Added `CMakePresets.json` for Windows, Linux, and macOS development.
 - No further releases will be published to NuGet.org. Users who want newer versions in .NET projects should build their own NuGet package from source.
diff --git a/cmake/ExternalBenchmark.cmake b/cmake/ExternalBenchmark.cmake
@@ -4,7 +4,7 @@
 FetchContent_Declare(
     benchmark
     GIT_REPOSITORY https://github.com/google/benchmark.git
-    GIT_TAG        afa23b7699c17f1e26c88cbf95257b20d78d6247 # 1.9.2
+    GIT_TAG        192ef10025eb2c4cdd392bc502f0c852196baa48 # 1.9.5
 )
 FetchContent_GetProperties(benchmark)
 
diff --git a/cmake/ExternalGTest.cmake b/cmake/ExternalGTest.cmake
@@ -4,7 +4,7 @@
 FetchContent_Declare(
     googletest
     GIT_REPOSITORY https://github.com/google/googletest.git
-    GIT_TAG        6910c9d9165801d8827d628cb72eb7ea9dd538c5 # 1.16.0
+    GIT_TAG        52eb8108c5bdec04579160ae17225d66034bd723 # 1.17.0
 )
 FetchContent_GetProperties(googletest)
 
diff --git a/cmake/ExternalMSGSL.cmake b/cmake/ExternalMSGSL.cmake
@@ -4,7 +4,7 @@
 FetchContent_Declare(
     msgsl
     GIT_REPOSITORY https://github.com/microsoft/GSL.git
-    GIT_TAG        2828399820ef4928cc89b65605dca5dc68efca6e # 4.2.0
+    GIT_TAG        249146590e322123cd0b378b1f364d6069717687 # 4.2.1
 )
 FetchContent_GetProperties(msgsl)
 
diff --git a/cmake/ExternalZLIB.cmake b/cmake/ExternalZLIB.cmake
@@ -3,7 +3,7 @@
 FetchContent_Declare(
     zlib
     GIT_REPOSITORY https://github.com/madler/zlib.git
-    GIT_TAG        51b7f2abdade71cd9bb0e7a373ef2610ec6f9daf # 1.3.1
+    GIT_TAG        da607da739fa6047df13e66a2af6b8bec7c2a498 # 1.3.2
 )
 FetchContent_GetProperties(zlib)
 
diff --git a/native/src/seal/c/defines.h b/native/src/seal/c/defines.h
@@ -48,7 +48,7 @@ static_assert(false, "Require architecture == x64");
 
 #define FACILITY_WIN32 7
 #define HRESULT_FROM_WIN32(x) \
-    ((HRESULT)(x) <= 0 ? ((HRESULT)(x)) : ((HRESULT)(((x)&0x0000FFFF) | (FACILITY_WIN32 << 16) | 0x80000000)))
+    ((HRESULT)(x) <= 0 ? ((HRESULT)(x)) : ((HRESULT)(((x) & 0x0000FFFF) | (FACILITY_WIN32 << 16) | 0x80000000)))
 
 #define ERROR_INSUFFICIENT_BUFFER 122L
 #define ERROR_INVALID_INDEX 1413L
diff --git a/native/src/seal/ckks.cpp b/native/src/seal/ckks.cpp
@@ -99,15 +99,31 @@ namespace seal
         }
 
         // Check that scale is positive and not too large
-        if (scale <= 0 || (static_cast<int>(log2(scale)) >= context_data.total_coeff_modulus_bit_count()))
+        if (!isfinite(scale) || scale <= 0 ||
+            (static_cast<int>(log2(scale)) >= context_data.total_coeff_modulus_bit_count()))
         {
             throw invalid_argument("scale out of bounds");
         }
 
+        // Reject non-finite user input up front.
+        if (!isfinite(value))
+        {
+            throw invalid_argument("value must be finite");
+        }
+
         // Compute the scaled value
         value *= scale;
 
-        int coeff_bit_count = static_cast<int>(log2(fabs(value))) + 2;
+        // Catch overflow in value * scale before the cast: even finite
+        // operands can produce inf here.
+        if (!isfinite(value))
+        {
+            throw invalid_argument("encoded value is too large");
+        }
+
+        // Guard against fabs(value) < 1 (log2 negative or -inf -> UB on cast).
+        // Anything with magnitude below 1 fits trivially in the fast path.
+        int coeff_bit_count = (fabs(value) < 1.0) ? 2 : (static_cast<int>(log2(fabs(value))) + 2);
         if (coeff_bit_count >= context_data.total_coeff_modulus_bit_count())
         {
             throw invalid_argument("encoded value is too large");
diff --git a/native/src/seal/ckks.h b/native/src/seal/ckks.h
@@ -481,11 +481,32 @@ namespace seal
             }
 
             // Check that scale is positive and not too large
-            if (scale <= 0 || (static_cast<int>(log2(scale)) + 1 >= context_data.total_coeff_modulus_bit_count()))
+            if (!std::isfinite(scale) || scale <= 0 ||
+                (static_cast<int>(log2(scale)) + 1 >= context_data.total_coeff_modulus_bit_count()))
             {
                 throw std::invalid_argument("scale out of bounds");
             }
 
+            // Reject non-finite user inputs up front so they can't drive the
+            // FFT into producing inf/NaN coefficients.
+            for (std::size_t i = 0; i < values_size; i++)
+            {
+                if constexpr (std::is_same<std::remove_cv_t<T>, double>::value)
+                {
+                    if (!std::isfinite(values[i]))
+                    {
+                        throw std::invalid_argument("values must be finite");
+                    }
+                }
+                else
+                {
+                    if (!std::isfinite(values[i].real()) || !std::isfinite(values[i].imag()))
+                    {
+                        throw std::invalid_argument("values must be finite");
+                    }
+                }
+            }
+
             auto ntt_tables = context_data.small_ntt_tables();
 
             // values_size is guaranteed to be no bigger than slots_
@@ -506,10 +527,16 @@ namespace seal
             {
                 max_coeff = std::max<>(max_coeff, std::fabs(conj_values[i].real()));
             }
+            // Catch FFT overflow before the cast: even finite inputs can
+            // produce inf coefficients after multiplication by scale/n.
+            if (!std::isfinite(max_coeff))
+            {
+                throw std::invalid_argument("encoded values are too large");
+            }
             // Verify that the values are not too large to fit in coeff_modulus
             // Note that we have an extra + 1 for the sign bit
             // Don't compute logarithmis of numbers less than 1
-            int max_coeff_bit_count = static_cast<int>(std::ceil(std::log2(std::max<>(max_coeff, 1.0)))) + 1;
+            int max_coeff_bit_count = util::safe_ceil_log2_int(std::max<>(max_coeff, 1.0)) + 1;
             if (max_coeff_bit_count >= context_data.total_coeff_modulus_bit_count())
             {
                 throw std::invalid_argument("encoded values are too large");
@@ -661,7 +688,7 @@ namespace seal
             auto ntt_tables = context_data.small_ntt_tables();
 
             // Check that scale is positive and not too large
-            if (plain.scale() <= 0 ||
+            if (!std::isfinite(plain.scale()) || plain.scale() <= 0 ||
                 (static_cast<int>(log2(plain.scale())) >= context_data.total_coeff_modulus_bit_count()))
             {
                 throw std::invalid_argument("scale out of bounds");
diff --git a/native/src/seal/evaluator.cpp b/native/src/seal/evaluator.cpp
@@ -44,7 +44,7 @@ namespace seal
                 scale_bit_count_bound = -1;
             };
 
-            return !(scale <= 0 || (static_cast<int>(log2(scale)) >= scale_bit_count_bound));
+            return !(!isfinite(scale) || scale <= 0 || (static_cast<int>(log2(scale)) >= scale_bit_count_bound));
         }
 
         /**
diff --git a/native/src/seal/memorymanager.h b/native/src/seal/memorymanager.h
@@ -483,7 +483,7 @@ namespace seal
         instructions to the memory manager profile for internal logic.
         */
         template <typename... Args>
-        SEAL_NODISCARD static inline MemoryPoolHandle GetPool(mm_prof_opt_t prof_opt, Args &&... args)
+        SEAL_NODISCARD static inline MemoryPoolHandle GetPool(mm_prof_opt_t prof_opt, Args &&...args)
         {
             switch (prof_opt)
             {
diff --git a/native/src/seal/util/clang.h b/native/src/seal/util/clang.h
@@ -16,7 +16,7 @@
 #ifdef SEAL_USE_ALIGNED_ALLOC
 #include <cstdlib>
 #define SEAL_MALLOC(size) \
-    static_cast<seal_byte *>((((size)&63) == 0) ? std::aligned_alloc(64, (size)) : std::malloc((size)))
+    static_cast<seal_byte *>((((size) & 63) == 0) ? std::aligned_alloc(64, (size)) : std::malloc((size)))
 #define SEAL_FREE(ptr) std::free(ptr)
 #endif
 
diff --git a/native/src/seal/util/common.h b/native/src/seal/util/common.h
@@ -178,7 +178,7 @@ namespace seal
         }
 
         template <typename T, typename... Args, typename = std::enable_if_t<std::is_integral<T>::value>>
-        SEAL_NODISCARD inline constexpr T mul_safe(T in1, T in2, Args &&... args)
+        SEAL_NODISCARD inline constexpr T mul_safe(T in1, T in2, Args &&...args)
         {
             return mul_safe(mul_safe(in1, in2), mul_safe(std::forward<Args>(args)...));
         }
@@ -214,7 +214,7 @@ namespace seal
         }
 
         template <typename T, typename... Args, typename = std::enable_if_t<std::is_arithmetic<T>::value>>
-        SEAL_NODISCARD inline constexpr T add_safe(T in1, T in2, Args &&... args)
+        SEAL_NODISCARD inline constexpr T add_safe(T in1, T in2, Args &&...args)
         {
             return add_safe(add_safe(in1, in2), add_safe(std::forward<Args>(args)...));
         }
@@ -318,25 +318,25 @@ namespace seal
         }
 
         template <typename T, typename... Args, typename = std::enable_if_t<std::is_arithmetic<T>::value>>
-        SEAL_NODISCARD inline constexpr bool sum_fits_in(Args &&... args)
+        SEAL_NODISCARD inline constexpr bool sum_fits_in(Args &&...args)
         {
             return fits_in<T>(add_safe(std::forward<Args>(args)...));
         }
 
         template <typename T, typename... Args, typename = std::enable_if_t<std::is_arithmetic<T>::value>>
-        SEAL_NODISCARD inline constexpr bool sum_fits_in(T in1, Args &&... args)
+        SEAL_NODISCARD inline constexpr bool sum_fits_in(T in1, Args &&...args)
         {
             return fits_in<T>(add_safe(in1, std::forward<Args>(args)...));
         }
 
         template <typename T, typename... Args, typename = std::enable_if_t<std::is_arithmetic<T>::value>>
-        SEAL_NODISCARD inline constexpr bool product_fits_in(Args &&... args)
+        SEAL_NODISCARD inline constexpr bool product_fits_in(Args &&...args)
         {
             return fits_in<T>(mul_safe(std::forward<Args>(args)...));
         }
 
         template <typename T, typename... Args, typename = std::enable_if_t<std::is_arithmetic<T>::value>>
-        SEAL_NODISCARD inline constexpr bool product_fits_in(T in1, Args &&... args)
+        SEAL_NODISCARD inline constexpr bool product_fits_in(T in1, Args &&...args)
         {
             return fits_in<T>(mul_safe(in1, std::forward<Args>(args)...));
         }
@@ -579,6 +579,29 @@ namespace seal
             return value == T{ 0 };
         }
 
+        // True iff x is finite, non-negative, and strictly less than 2^64.
+        // Use before any static_cast<uint64_t>(double): the cast is UB for
+        // inf, NaN, negative, or out-of-range inputs.
+        SEAL_NODISCARD inline bool is_safe_uint64_cast(double x) noexcept
+        {
+            // 2^64 is exactly representable as a double; values >= it round up
+            // out of uint64_t range.
+            constexpr double two_pow_64 = 18446744073709551616.0;
+            return std::isfinite(x) && x >= 0.0 && x < two_pow_64;
+        }
+
+        // Returns ceil(log2(x)) as int. Throws invalid_argument if x is not
+        // finite or not strictly positive. Use instead of
+        // static_cast<int>(ceil(log2(x))), which is UB for x = inf/NaN/<=0.
+        SEAL_NODISCARD inline int safe_ceil_log2_int(double x)
+        {
+            if (!std::isfinite(x) || x <= 0.0)
+            {
+                throw std::invalid_argument("argument to log2 not finite and positive");
+            }
+            return static_cast<int>(std::ceil(std::log2(x)));
+        }
+
         void seal_memzero(void *data, std::size_t size);
     } // namespace util
 } // namespace seal
diff --git a/native/src/seal/util/gcc.h b/native/src/seal/util/gcc.h
@@ -22,7 +22,7 @@
 #ifdef SEAL_USE_ALIGNED_ALLOC
 #include <cstdlib>
 #define SEAL_MALLOC(size) \
-    static_cast<seal_byte *>((((size)&63) == 0) ? std::aligned_alloc(64, (size)) : std::malloc((size)))
+    static_cast<seal_byte *>((((size) & 63) == 0) ? std::aligned_alloc(64, (size)) : std::malloc((size)))
 #define SEAL_FREE(ptr) std::free(ptr)
 #endif
 
@@ -73,9 +73,9 @@ __extension__ typedef unsigned __int128 uint128_t;
 #endif
 
 // GCC intrinsics for _addcarry_u64 is disabled, for it compiles to slower code than add_uint64_generic.
-//#ifdef SEAL_USE__ADDCARRY_U64
-//#define SEAL_ADD_CARRY_UINT64(operand1, operand2, carry, result) _addcarry_u64(carry, operand1, operand2, result)
-//#endif
+// #ifdef SEAL_USE__ADDCARRY_U64
+// #define SEAL_ADD_CARRY_UINT64(operand1, operand2, carry, result) _addcarry_u64(carry, operand1, operand2, result)
+// #endif
 
 #ifdef SEAL_USE__SUBBORROW_U64
 #if ((__GNUC__ == 7) && (__GNUC_MINOR__ >= 2)) || (__GNUC__ >= 8)
diff --git a/native/src/seal/util/iterator.h b/native/src/seal/util/iterator.h
@@ -1846,7 +1846,7 @@ namespace seal
             template <typename... Ts>
             IterTuple(const std::tuple<Ts...> &tp)
                 : IterTuple(seal_apply(
-                      [](auto &&... args) -> self_type { return self_type(std::forward<decltype(args)>(args)...); },
+                      [](auto &&...args) -> self_type { return self_type(std::forward<decltype(args)>(args)...); },
                       std::forward<decltype(tp)>(tp)))
             {
                 static_assert(
@@ -1856,7 +1856,7 @@ namespace seal
             template <typename... Ts>
             IterTuple(std::tuple<Ts...> &&tp)
                 : IterTuple(seal_apply(
-                      [](auto &&... args) -> self_type { return self_type(std::forward<decltype(args)>(args)...); },
+                      [](auto &&...args) -> self_type { return self_type(std::forward<decltype(args)>(args)...); },
                       std::forward<decltype(tp)>(tp)))
             {
                 static_assert(
@@ -1870,9 +1870,7 @@ namespace seal
             SEAL_NODISCARD inline value_type operator*() const noexcept
             {
                 return seal_apply(
-                    [this](auto &&... args) -> value_type {
-                        return { *first_, std::forward<decltype(args)>(args)... };
-                    },
+                    [this](auto &&...args) -> value_type { return { *first_, std::forward<decltype(args)>(args)... }; },
                     *rest_);
             }
 
@@ -2283,13 +2281,13 @@ namespace seal
         }
 
         template <typename... Ts>
-        SEAL_NODISCARD inline auto iter(Ts &&... ts) noexcept -> typename iterator_internal::IterType<void, Ts...>::type
+        SEAL_NODISCARD inline auto iter(Ts &&...ts) noexcept -> typename iterator_internal::IterType<void, Ts...>::type
         {
             return { std::forward<Ts>(ts)... };
         }
 
         template <typename... Ts>
-        SEAL_NODISCARD inline auto reverse_iter(Ts &&... ts) noexcept
+        SEAL_NODISCARD inline auto reverse_iter(Ts &&...ts) noexcept
             -> ReverseIter<typename iterator_internal::IterType<void, Ts...>::type>
         {
             return typename iterator_internal::IterType<void, Ts...>::type(std::forward<Ts>(ts)...);
diff --git a/native/src/seal/util/msvc.h b/native/src/seal/util/msvc.h
@@ -34,20 +34,23 @@
 #else
 
 #ifdef SEAL_USE_IF_CONSTEXPR
-#pragma message("Disabling `if constexpr` based on _MSVC_LANG value " SEAL_STRINGIZE( \
-    _MSVC_LANG) ": undefining SEAL_USE_IF_CONSTEXPR")
+#pragma message(                                                          \
+    "Disabling `if constexpr` based on _MSVC_LANG value " SEAL_STRINGIZE( \
+        _MSVC_LANG) ": undefining SEAL_USE_IF_CONSTEXPR")
 #undef SEAL_USE_IF_CONSTEXPR
 #endif
 
 #ifdef SEAL_USE_MAYBE_UNUSED
-#pragma message("Disabling `[[maybe_unused]]` based on _MSVC_LANG value " SEAL_STRINGIZE( \
-    _MSVC_LANG) ": undefining SEAL_USE_MAYBE_UNUSED")
+#pragma message(                                                              \
+    "Disabling `[[maybe_unused]]` based on _MSVC_LANG value " SEAL_STRINGIZE( \
+        _MSVC_LANG) ": undefining SEAL_USE_MAYBE_UNUSED")
 #undef SEAL_USE_MAYBE_UNUSED
 #endif
 
 #ifdef SEAL_USE_NODISCARD
-#pragma message("Disabling `[[nodiscard]]` based on _MSVC_LANG value " SEAL_STRINGIZE( \
-    _MSVC_LANG) ": undefining SEAL_USE_NODISCARD")
+#pragma message(                                                           \
+    "Disabling `[[nodiscard]]` based on _MSVC_LANG value " SEAL_STRINGIZE( \
+        _MSVC_LANG) ": undefining SEAL_USE_NODISCARD")
 #undef SEAL_USE_NODISCARD
 #endif
 #endif
diff --git a/native/src/seal/util/pointer.h b/native/src/seal/util/pointer.h
diff --git a/native/src/seal/util/rlwe.cpp b/native/src/seal/util/rlwe.cpp
diff --git a/native/tests/seal/ckks.cpp b/native/tests/seal/ckks.cpp
diff --git a/pipelines/windows.yml b/pipelines/windows.yml
diff --git a/tools/config/packages.config b/tools/config/packages.config
diff --git a/tools/scripts/clang-format-all.sh b/tools/scripts/clang-format-all.sh

Original file line number	Diff line number	Diff line change
`@@ -4,7 +4,7 @@`
`4`	`4`	`FetchContent_Declare(`
`5`	`5`	`benchmark`
`6`	`6`	`GIT_REPOSITORY https://github.com/google/benchmark.git`
`7`		`- GIT_TAG afa23b7699c17f1e26c88cbf95257b20d78d6247 # 1.9.2`
	`7`	`+ GIT_TAG 192ef10025eb2c4cdd392bc502f0c852196baa48 # 1.9.5`
`8`	`8`	`)`
`9`	`9`	`FetchContent_GetProperties(benchmark)`
`10`	`10`
Original file line number	Diff line number	Diff line change
`@@ -4,7 +4,7 @@`
`4`	`4`	`FetchContent_Declare(`
`5`	`5`	`googletest`
`6`	`6`	`GIT_REPOSITORY https://github.com/google/googletest.git`
`7`		`- GIT_TAG 6910c9d9165801d8827d628cb72eb7ea9dd538c5 # 1.16.0`
	`7`	`+ GIT_TAG 52eb8108c5bdec04579160ae17225d66034bd723 # 1.17.0`
`8`	`8`	`)`
`9`	`9`	`FetchContent_GetProperties(googletest)`
`10`	`10`
Original file line number	Diff line number	Diff line change
`@@ -4,7 +4,7 @@`
`4`	`4`	`FetchContent_Declare(`
`5`	`5`	`msgsl`
`6`	`6`	`GIT_REPOSITORY https://github.com/microsoft/GSL.git`
`7`		`- GIT_TAG 2828399820ef4928cc89b65605dca5dc68efca6e # 4.2.0`
	`7`	`+ GIT_TAG 249146590e322123cd0b378b1f364d6069717687 # 4.2.1`
`8`	`8`	`)`
`9`	`9`	`FetchContent_GetProperties(msgsl)`
`10`	`10`
Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,7 @@`
`3`	`3`	`FetchContent_Declare(`
`4`	`4`	`zlib`
`5`	`5`	`GIT_REPOSITORY https://github.com/madler/zlib.git`
`6`		`- GIT_TAG 51b7f2abdade71cd9bb0e7a373ef2610ec6f9daf # 1.3.1`
	`6`	`+ GIT_TAG da607da739fa6047df13e66a2af6b8bec7c2a498 # 1.3.2`
`7`	`7`	`)`
`8`	`8`	`FetchContent_GetProperties(zlib)`
`9`	`9`
Original file line number	Diff line number	Diff line change
`@@ -44,7 +44,7 @@ namespace seal`
`44`	`44`	`scale_bit_count_bound = -1;`
`45`	`45`	`};`
`46`	`46`
`47`		`- return !(scale <= 0 \|\| (static_cast<int>(log2(scale)) >= scale_bit_count_bound));`
	`47`	`+ return !(!isfinite(scale) \|\| scale <= 0 \|\| (static_cast<int>(log2(scale)) >= scale_bit_count_bound));`
`48`	`48`	`}`
`49`	`49`
`50`	`50`	`/**`
Original file line number	Diff line number	Diff line change
`@@ -483,7 +483,7 @@ namespace seal`
`483`	`483`	`instructions to the memory manager profile for internal logic.`
`484`	`484`	`*/`
`485`	`485`	`template <typename... Args>`
`486`		`- SEAL_NODISCARD static inline MemoryPoolHandle GetPool(mm_prof_opt_t prof_opt, Args &&... args)`
	`486`	`+ SEAL_NODISCARD static inline MemoryPoolHandle GetPool(mm_prof_opt_t prof_opt, Args &&...args)`
`487`	`487`	`{`
`488`	`488`	`switch (prof_opt)`
`489`	`489`	`{`