[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200423161435.GT11469@brightrain.aerifal.cx>
Date: Thu, 23 Apr 2020 12:14:35 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: Re: Invalid pointer subtractions in __shlim and __shgetc
On Thu, Apr 23, 2020 at 11:34:26AM +0000, Pascal Cuoq wrote:
> Hello again,
>
> Rich Felker <dalias@...c.org> wrote:
> > I think this patch may result in wrong error behavior on a trivial
> > scanf that doesn't try to read anything. Instead it should be:
> >
> > if (!f->rpos) __toread(f);
> > if (!f->rpos) goto input_fail;
> >
> > so that the error path is taken only on failure to enter read mode,
> > not on EOF.
>
> This has indeed fixed the invalid comparisons that were observed
> from the tests I mentioned earlier, but a different test still has
> the same problem.
>
> As of commit 33338eb, the function wcstox does:
> f.rpos = f.rend = 0;
> f.buf = buf + 4;
>
> (https://git.musl-libc.org/cgit/musl/tree/src/stdlib/wcstol.c?id=33338ebc853d37c80f0f236cc7a92cb0acc6aace#n38 )
>
> It then passes the address of this f to shlim (line 45), causing the
> same invalid pointer subtraction f->buf - f->rpos that has already
> been discussed in this thread.
Thanks. The attached should fix it, I think.
Rich
View attachment "wcstox.diff" of type "text/plain" (849 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
