Re: cluts memcpy() test

[Rich Felker <dalias@aerifal.cx>]

On Wed, Jul 20, 2011 at 12:30:35PM +0200, Luka M. wrote:
> On Wed, Jul 20, 2011 at 2:28 AM, Solar Designer <solar@openwall.com> wrote:
> 
> > Luka, Rich -
> >
> > It'd be nice for cluts to detect issues like this:
> >
> > http://www.nodefense.org/eglibc.txt
> >
> > Maybe it already does?
> >
> 
> Hey Alexander. Cluts doesn't test negative values for memcpy. Such a thing
> hasn't occured to me: The prototype for the function specifies a size_t
> argument, and size_t is supposed to be unsigned. This means, _afaik_, that a
> negative value should be implicitly cast to a positive "equivalent". So, I

The problem is (or rather was; I assume it's fixed now) broken asm in
glibc that treated the unsigned value as if it were signed...

Note that musl will not allow you to allocate memory so large that the
unsigned size would be negative if interpreted as a signed value,
since that would create dangerous situations where ptrdiff_t
overflows. It may still be possible to make a region that large
explicitly using mmap, however.

Rich