Subject says it all, more or less. Buggy source file is prprf.c, function dosprintf: if (u.l < 0) { u.l = -u.l; /* BUG: overflow if u.l equals LONG_MIN */ flags |= _NEG; } Same problem for long longs, a few lines further down. Th

Thanks for the bug report, and sorry about the delay. I saw what is wrong in the code. I will send you a patch soon and let you review and try it out.

Setting all current Open/Normal to M4.

per leger, assigning QA contacts to all open bugs without QA contacts according to list at http://bugzilla.mozilla.org/describecomponents.cgi?product=Browser

Need to track in js/src/jsprf.c, adding mccabe@netscape.com to cc: list. /be

moving to m6

NSPR now has its own Bugzilla product. Moving this bug to the NSPR product.

I looked at the code more carefully and found that it is fine. The code in question: if (u.l < 0) { u.l = -u.l; flags |= _NEG; } does overflow if u.l is LONG_MIN, but when u.l is passed to cvt_l, it is always cast to unsigned long before conversion, i.e., at the time of conversion, u.l is always treated as an unsigned long. So the overflow when it's treated as a signed type does not cause any harm. I suppose it might be clearer to declare u.l as an unsigned type. Here is a test program: ********* foo.c *********** #include "nspr.h" #include <limits.h> int main() { PR_fprintf(PR_STDOUT, "%ld %lld\n", LONG_MIN, LLONG_MIN); return 0; } ******** end foo.c ************ On Solaris 2.6, using the Workshop 4.2 compiler, I get the correct output: -2147483648 -9223372036854775808 Marked the bug invalid.

sounds good to me - marking verified