From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL autolearn=ham autolearn_force=no version=3.4.2 Received: (qmail 5751 invoked from network); 24 Apr 2020 14:12:56 -0000 Received: from mother.openwall.net (195.42.179.200) by inbox.vuxu.org with UTF8ESMTPZ; 24 Apr 2020 14:12:56 -0000 Received: (qmail 11971 invoked by uid 550); 24 Apr 2020 14:12:52 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 11940 invoked from network); 24 Apr 2020 14:12:51 -0000 Date: Fri, 24 Apr 2020 10:12:39 -0400 From: Rich Felker To: musl@lists.openwall.com Message-ID: <20200424141239.GE11469@brightrain.aerifal.cx> References: <1587138997905.95619@trust-in-soft.com> <20200417161351.GH11469@brightrain.aerifal.cx> <20200417164807.GI11469@brightrain.aerifal.cx> <20200417175651.GK11469@brightrain.aerifal.cx> <1587641710830.20636@trust-in-soft.com> <20200423161435.GT11469@brightrain.aerifal.cx> <1587721262422.2983@trust-in-soft.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1587721262422.2983@trust-in-soft.com> User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [musl] Invalid pointer subtractions in __shlim and __shgetc On Fri, Apr 24, 2020 at 09:40:15AM +0000, Pascal Cuoq wrote: > Hello, > > Rich Felker wrote: > > The attached should fix it, I think. > > The patch sets f.rpos and f.rend to buf+4, but it also leaves > f.buf containing 0 from “FILE f = {0};”: > --- a/src/stdlib/wcstol.c > +++ b/src/stdlib/wcstol.c > @@ -35,8 +35,7 @@ static unsigned long long wcstox(const wchar_t *s, wchar_t **p, int base, unsign > unsigned char buf[64]; > FILE f = {0}; > f.flags = 0; > - f.rpos = f.rend = 0; > - f.buf = buf + 4; > + f.rpos = f.rend = buf + 4; > f.buf_size = sizeof buf - 4; > f.lock = -1; > f.read = do_read; > > Unfortunately, the function __shlim also subtracts f.rpos from f.buf, at this line: > > f->shcnt = f->buf - f->rpos; Uhg, this was purely a mechanical error in the edit (selecting too much text to delete) and I should have tested before sending. Should be: - f.rpos = f.rend = 0; - f.buf = buf + 4; + f.rpos = f.rend = f.buf = buf + 4; > (https://git.musl-libc.org/cgit/musl/tree/src/internal/shgetc.c?id=33338ebc853d37c80f0f236cc7a92cb0acc6aace#n11 ) > > So that is now where the invalid subtraction happens. > > For what it's worth, we have tested the patch consisting in > initializing all three of f.rpos, f.rend and f.buf to buf+4, and that > does not cause UB in this test. But we can't tell if if provides the > correct functional behavior for this test and for other inputs. Yep, that's what I intended. Sorry for wasting your time with a bad patch. Rich