From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/12621 Path: news.gmane.org!.POSTED!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: Re: #define __MUSL__ in features.h Date: Thu, 15 Mar 2018 15:37:47 -0400 Message-ID: <20180315193747.GL1436@brightrain.aerifal.cx> References: <20180315183939.GI1436@brightrain.aerifal.cx> <20180315185358.GJ1436@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: blaine.gmane.org 1521142577 4598 195.159.176.226 (15 Mar 2018 19:36:17 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Thu, 15 Mar 2018 19:36:17 +0000 (UTC) User-Agent: Mutt/1.5.21 (2010-09-15) To: musl@lists.openwall.com Original-X-From: musl-return-12635-gllmg-musl=m.gmane.org@lists.openwall.com Thu Mar 15 20:36:13 2018 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.84_2) (envelope-from ) id 1ewYfb-00014V-69 for gllmg-musl@m.gmane.org; Thu, 15 Mar 2018 20:36:11 +0100 Original-Received: (qmail 23595 invoked by uid 550); 15 Mar 2018 19:38:02 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 22453 invoked from network); 15 Mar 2018 19:37:59 -0000 Content-Disposition: inline In-Reply-To: Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:12621 Archived-At: On Thu, Mar 15, 2018 at 04:00:37PM -0300, dgutson . wrote: > On Thu, Mar 15, 2018 at 3:53 PM, Rich Felker wrote: > > > On Thu, Mar 15, 2018 at 03:48:32PM -0300, Martin Galvan wrote: > > > 2018-03-15 15:39 GMT-03:00 Rich Felker : > > > >> (e.g. the FD* issue reported by Martin Galvan). > > > > > > > > That's not a bug. It's compiler warnings being wrongly produced for a > > > > system header, probably because someone added -I/usr/include or > > > > similar (normally GCC suppresses these). > > > > > > I'm certain we didn't add -I/usr/include or something similar. Could > > > you test this yourself to confirm it's not a bug? > > > > In any case it's not a bug in musl. The code is perfectly valid C. If > > the compiler is producing a warning for it, either ignore it or ask > > the compiler to stop. > > > > > The compiler warnings aren't being wrongly produced. musl will indeed > > > perform a signed-to-unsigned conversion here. > > > > Because that's how the C language works. > > > > it is a potential vulnerability: > https://cwe.mitre.org/data/definitions/195.html > https://wiki.sei.cmu.edu/confluence/display/c/INT31-C.+Ensure+that+integer+conversions+do+not+result+in+lost+or+misinterpreted+data > https://wiki.sei.cmu.edu/confluence/display/c/INT30-C.+Ensure+that+unsigned+integer+operations+do+not+wrap > > Can you ensure it is rocksolid and the signed integer will NEVER be a > negative value? FD_* have undefined behavior if the argument is outside the range of FD_SETSIZE. We could trap this (and if you use fortify headers, they do) but doing so breaks applications that wrongly allocate larger space for fd_set buffers for the sake of intentionally using larger fd values than are possible with the select API. The behavior of the code with or without the cast to unsigned added is _exactly the same_. There is no bug here that is fixed by the proposed patch. The warning is telling you that, if you don't understand how integer promotions work in C, the code might not do what you expected it to do. The fact that you seem to think adding a cast "fixes a bug" is demonstrating how harmful the whole cult around compiler warnings is: it's not about using them as hints to check your code and make sure it's doing what you want, but instead about making the warning go away without actually changing anything. Rich