[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20261111134143.GB5716@brightrain.aerifal.cx>
Date: Wed, 11 Nov 2026 08:41:43 -0500
From: Rich Felker <dalias@...c.org>
To: Trevor Gross <tg@...vorgross.com>
Cc: musl@...ts.openwall.com
Subject: Re: Possible out of bounds read in memchr
On Wed, Nov 11, 2026 at 01:20:12PM +0000, Trevor Gross wrote:
> Hello,
>
> The C spec for `memchr` states:
>
> > The memchr generic function locates the first occurrence of c
> > (converted to an unsigned char) in the initial n characters (each
> > interpreted as unsigned char) of the object pointed to by s. The
> > implementation shall behave as if it reads the characters sequentially
> > and stops as soon as a matching character is found.
>
> The last bit implies that the provided length parameter is allowed to
> exceed the actual length of the buffer and the implementation must not
> read out of bounds. However, if I'm reading correctly, it appears that
> there is a `size_t`-sized read of `w` at [1], which may be partially out
> of bounds if the needle exists early in that word. Sample:
>
> int len = 2;
> char *s = malloc(len);
> memset(s, 0, len);
> s[1] = 1;
> r = memchr(s, 1, 1024);
>
> AddressSanitizer corroborates the issue, see [2].
>
> Sending to the public list because this is unlikely to be problematic
> and already has some public discussion (Rust Zulip).
This is known and intentional. It would be nice if we had a way to
express the intent, like a variant of the may_alias attribute, but i
think we'd have to write a load in inline asm to make this formally
correct. I'm open to changing it, because I don't like having the
kinds of hacks this is now, but I'm not sure what's best.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
