[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200430235525.GK21576@brightrain.aerifal.cx>
Date: Thu, 30 Apr 2020 19:55:25 -0400
From: Rich Felker <dalias@...c.org>
To: Alfred Agrell <alfred@...ell.info>
Cc: musl@...ts.openwall.com
Subject: Re: bug: integer overflow in memmem()
On Thu, Apr 30, 2020 at 08:17:39PM +0200, Alfred Agrell wrote:
> To reproduce: Compile src/string/memmem.c with -fsanitize=undefined, then
>
> int main()
> {
> char a[4] = { -1,-1,-1,-1 };
> memmem(a, 4, a, 3);
> memmem(a, 4, a, 4);
> }
>
> Expected result: No output
>
> Actual (Ubuntu 18.04 x86_64, gcc 7.5.0, ):
>
> memmem.c:15:20: runtime error: left shift of 255 by 24 places cannot
> be represented in type 'int'
> memmem.c:16:20: runtime error: left shift of 255 by 24 places cannot
> be represented in type 'int'
> memmem.c:24:20: runtime error: left shift of 255 by 24 places cannot
> be represented in type 'int'
> memmem.c:25:20: runtime error: left shift of 255 by 24 places cannot
> be represented in type 'int'
>
> C's integer promotion rules are fairly unintuitive for <<; it
> promotes unsigned small LHS to signed. To fix, change the two
> n[0]<<24 to (uint32_t)n[0]<<24, and similar for h[0]<<24.
>
> I'm not aware of any compiler on any platform where it'll actually
> break, so your choice whether this is a real bug. I didn't check if
> similar issues exist elsewhere across musl.
>
> I'm not subscribed to the list; I'll read the archives, but if you
> want a timely response, please cc me.
Thanks. It looks like the same thing happens in strstr. I'm almost
sure this (the strstr one) was reported in the past and I thought it
was fixed, but apparently not. I'll fix both of them now.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
