From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/8639 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: Signed integer overflow in __secs_to_tm Date: Thu, 8 Oct 2015 19:47:27 -0400 Message-ID: <20151008234727.GD8645@brightrain.aerifal.cx> References: <56177AD6-23A7-44A5-B72B-D139DC14F813@mastenbrook.net> <20151007102253.GO10551@port70.net> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1444348065 26075 80.91.229.3 (8 Oct 2015 23:47:45 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Thu, 8 Oct 2015 23:47:45 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-8651-gllmg-musl=m.gmane.org@lists.openwall.com Fri Oct 09 01:47:44 2015 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1ZkKuT-0001Uo-TA for gllmg-musl@m.gmane.org; Fri, 09 Oct 2015 01:47:42 +0200 Original-Received: (qmail 11615 invoked by uid 550); 8 Oct 2015 23:47:39 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 11594 invoked from network); 8 Oct 2015 23:47:39 -0000 Content-Disposition: inline In-Reply-To: <20151007102253.GO10551@port70.net> User-Agent: Mutt/1.5.21 (2010-09-15) Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:8639 Archived-At: On Wed, Oct 07, 2015 at 12:22:53PM +0200, Szabolcs Nagy wrote: > * Brian Mastenbrook [2015-10-06 19:09:45 -0500]: > > __secs_to_tm (used by gmtime_r et al) may invoke undefined > > behavior due to signed integer overflow in two places. At > > __secs_to_tm.c:58, 400*qc_cycles may overflow. At > > __secs_to_tm.c:63, there is a nonsensical comparison between an > > already overflowed value and INT_MAX or INT_MIN; the compiler will > > delete this test due to overflow. Here are some example values > > that provoke the overflow: > > > > i think that computation was supposed to be done > with long longs and then the comparision is > sensical and both problems go away. > > can you try the attached patch? It looks good to me. I'm applying it. Thanks! Rich