From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/9079 Path: news.gmane.org!not-for-mail From: Markus Wichmann Newsgroups: gmane.linux.lib.musl.general Subject: Re: Possible infinite loop in qsort() Date: Sun, 10 Jan 2016 12:38:53 +0100 Message-ID: <20160110113852.GE2016@debian> References: <20160109082139.GD2016@debian> <20160109090719.GA385@nyan> <20160110040516.GQ238@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1452425954 21572 80.91.229.3 (10 Jan 2016 11:39:14 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sun, 10 Jan 2016 11:39:14 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-9092-gllmg-musl=m.gmane.org@lists.openwall.com Sun Jan 10 12:39:09 2016 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1aIEKz-0003VS-Ac for gllmg-musl@m.gmane.org; Sun, 10 Jan 2016 12:39:09 +0100 Original-Received: (qmail 15564 invoked by uid 550); 10 Jan 2016 11:39:06 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 15544 invoked from network); 10 Jan 2016 11:39:05 -0000 Content-Disposition: inline In-Reply-To: <20160110040516.GQ238@brightrain.aerifal.cx> User-Agent: Mutt/1.5.23 (2014-03-12) X-Provags-ID: V03:K0:dvKQCXbtK2wFOc1Omlh6lI93/J+VwchacZ+nJkTaezT8wzq+CED H944szxMYfCKN0xQudNTgMFCtmWveTVWi7Y0eMyzG8ZR399xsUw+yKNew6miRn1uJEjpeQQ D81Ia5M1XXlzuRDNs5HV5Gap4XyUlgj4vPBnwQlF/AKJvoA823H74beqnZm3/i1Gtzz4lho Ya4Afpjovb+KsDSlfz6Tw== X-UI-Out-Filterresults: notjunk:1;V01:K0:Sqig+09vm9E=:wS5hQYGPB32c6xn4DeRgBY G5cuvfW/k3DQgMnR7AV36JYeDI3CW3gYfW+s+35LFvAApz2W0rZ35+7xt0sb33A2YYJB4rCQZ hLQqj9tSQvb7JgQif3iCWgoMw8aPk18yfwBBt8Vk3Nv7Fxn9mlaaHQAWLx3zFoO8WcYqGaqjg cKBel+anstM9U6607uDoKlpLIZDsuqQeRjWo3N1zknF3zQ53h2CcmwJ2iFhe+S+KHncV/IVYb 8vjksGxWe2bzX2W9PfXI8vkOK0yMFHWWOPtQKGgz4efkTvXcj1O5/3TvGkFtkmJgKZ2RnmsEw Qs1wUeBcRwWZbeQL1cp2/GDr0cwo7kypXGMJGhALXSUGc+sYi6OEE9yYIhTmF9SIeJQoaKCq4 29dGsQNO7poo8+nmRfQXIRgY6oqkDLsUy8SgturLbcIdSIyyfRxqoSvfYYyOUslU4MRsS9TWU /veJtQ+k5DY/LfutzUJMR61aPqx5eqS9nSOFAHSCJCY4y4P+0CJndQvQZDw4rYoNOlpIcc9kb qU7ym4zbBBBE8KOfja1ufWBejU1NDzp88tZ+r2tjHMTINST/eO/pE+I0URgkQ54WQz9r/ifLK Qm1c5sZJkVBV597q8WswgL4CwHigI/qziNQrdU2yVVbbyhWtK8kUuaJ4AyRg36eBVhl8MZ4F3 L9Bsc46lZN0DiOZg/BhPg20fiWUGUo02nPG956MDdRKye+Dld/jZWqupOitspsI0/WXVsPkhp YJZOzxXYldMdA1egJc7jDas48/dAoPU6ZiZAwIRhCmrGXuivdkOlRg+ZdNk= Xref: news.gmane.org gmane.linux.lib.musl.general:9079 Archived-At: On Sat, Jan 09, 2016 at 11:05:16PM -0500, Rich Felker wrote: > On Sat, Jan 09, 2016 at 10:07:19AM +0100, Felix Janda wrote: > > musl enforces that object sizes should not be greater than PTRDIFF_MAX. > > See for example the discussion at > > > > http://www.openwall.com/lists/musl/2013/06/27/7 > > > > So there will not be objects of size 3GB with musl on x32. Since the > > Leonardo numbers grow slower than 2^n in general no overflow should > > happen if "size" is valid. Otherwise, UB was invoked. > OK. Might want to make that assumption a bit more prominent, because this is the first time I've ever heard about it, but OK, no objects >2GB on 32-bit archs. > Note also that if you do want to use this code on an implementation > without such a guarantee, only the case where the member size is 1 can > possibly have >SIZE_MAX/2 members. Maybe, but the point was that you can overflow the Leonardo number calculation for any given width. Re-read the example I gave: It was less than 900,000,000 ints you needed to overflow the calculation. What I did was make sure that nel * width is greater than the greatest Leonardo number * width that's representable in the architecture's size_t. That is possible for every given width. The inequation I just gave boils down to nel > max{l | l is Leonardo number, l * width < 2^32} But since there are (plenty of) Leonardo numbers between 2^31 and 2^32, and object size (nel * width) is limited to <2^31, with a valid object the calculation can't overflow. And with an invalid object, I don't know if the code as given would even work, as pointer differences wouldn't work. Haven't tested that one, either. Ciao, Markus