Re: Signed integer overflow in __secs_to_tm

[Jens Gustedt <jens.gustedt@inria.fr>]

[-- Attachment #1: Type: text/plain, Size: 1521 bytes --]

Hello,

Am Dienstag, den 06.10.2015, 19:09 -0500 schrieb Brian Mastenbrook:
> __secs_to_tm (used by gmtime_r et al) may invoke undefined behavior due to signed integer overflow in two places. At __secs_to_tm.c:58, 400*qc_cycles may overflow. At __secs_to_tm.c:63, there is a nonsensical comparison between an already overflowed value and INT_MAX or INT_MIN; the compiler will delete this test due to overflow. Here are some example values that provoke the overflow:
> 
> t = -67771633420944000
> 
> __secs_to_tm.c:58:[kernel] warning: signed overflow. assert -2147483648 ≤ 400*qc_cycles;
> 
> t = 67768037838810496
> 
> __secs_to_tm.c:63:[kernel] warning: signed overflow. assert years+100 ≤ 2147483647;
> 
> These errors were found using KLEE and clang's undefined behavior sanitizer together. (Unfortunately KLEE also produced a false report of an out-of-bounds access to the days_in_month array due to a solver bug.)

There is a test in line 21 that is intended to inhibit that, I
think. The error there seems to be that it doesn't take the shift by
100 years into account.

If that test would use corrected constants, the overflow test that you
found should be superfluous.

Jens


-- 
:: INRIA Nancy Grand Est ::: Camus ::::::: ICube/ICPS :::
:: ::::::::::::::: office Strasbourg : +33 368854536   ::
:: :::::::::::::::::::::: gsm France : +33 651400183   ::
:: ::::::::::::::: gsm international : +49 15737185122 ::
:: http://icube-icps.unistra.fr/index.php/Jens_Gustedt ::




[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 181 bytes --]