Even if the signed integer operation overflow were not UB but implied wrapping, the purported post-factum check in the article is not semantically equivalent to

Even if the signed integer operation overflow were not UB but implied wrapping, the purported post-factum check in the article is not semantically equivalent to properly checking the range beforehand. "if ((INT32_MAX / 0x1ff) <= x) { ... }" is not the same as "int32_t i = x * 0x1ff / 0xffff; if (i >= 0 && i < sizeof(tab)) { ... }". The reason for the difference is that the result might get into the permitted range accidentally. The function should have returned zero (as it does for out-of-range inputs) but returned some element of a table. The same bug exists in their Rust code.