From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on inbox.vuxu.org
X-Spam-Level: 
X-Spam-Status: No, score=-3.3 required=5.0 tests=MAILING_LIST_MULTI,
	RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_PASS
	autolearn=ham autolearn_force=no version=3.4.2
Received: (qmail 18595 invoked from network); 30 Apr 2020 23:55:39 -0000
Received-SPF:  pass (mother.openwall.net: domain of lists.openwall.com
  designates 195.42.179.200 as permitted sender)
  receiver=inbox.vuxu.org; client-ip=195.42.179.200
  envelope-from=<musl-return-15849-ml=inbox.vuxu.org@lists.openwall.com>
Received: from mother.openwall.net (195.42.179.200)
  by inbox.vuxu.org with ESMTPUTF8; 30 Apr 2020 23:55:39 -0000
Received: (qmail 1090 invoked by uid 550); 30 Apr 2020 23:55:38 -0000
Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm
Precedence: bulk
List-Post: <mailto:musl@lists.openwall.com>
List-Help: <mailto:musl-help@lists.openwall.com>
List-Unsubscribe: <mailto:musl-unsubscribe@lists.openwall.com>
List-Subscribe: <mailto:musl-subscribe@lists.openwall.com>
List-ID: <musl.lists.openwall.com>
Reply-To: musl@lists.openwall.com
Received: (qmail 1069 invoked from network); 30 Apr 2020 23:55:37 -0000
Date: Thu, 30 Apr 2020 19:55:25 -0400
From: Rich Felker <dalias@libc.org>
To: Alfred Agrell <alfred@agrell.info>
Cc: musl@lists.openwall.com
Message-ID: <20200430235525.GK21576@brightrain.aerifal.cx>
References: <8756d18a-28ce-dda6-6300-24ae208351c2@agrell.info>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <8756d18a-28ce-dda6-6300-24ae208351c2@agrell.info>
User-Agent: Mutt/1.5.21 (2010-09-15)
Subject: Re: [musl] bug: integer overflow in memmem()

On Thu, Apr 30, 2020 at 08:17:39PM +0200, Alfred Agrell wrote:
> To reproduce: Compile src/string/memmem.c with -fsanitize=undefined, then
> 
> int main()
> {
> char a[4] = { -1,-1,-1,-1 };
> memmem(a, 4, a, 3);
> memmem(a, 4, a, 4);
> }
> 
> Expected result: No output
> 
> Actual (Ubuntu 18.04 x86_64, gcc 7.5.0, ):
> 
> memmem.c:15:20: runtime error: left shift of 255 by 24 places cannot
> be represented in type 'int'
> memmem.c:16:20: runtime error: left shift of 255 by 24 places cannot
> be represented in type 'int'
> memmem.c:24:20: runtime error: left shift of 255 by 24 places cannot
> be represented in type 'int'
> memmem.c:25:20: runtime error: left shift of 255 by 24 places cannot
> be represented in type 'int'
> 
> C's integer promotion rules are fairly unintuitive for <<; it
> promotes unsigned small LHS to signed. To fix, change the two
> n[0]<<24 to (uint32_t)n[0]<<24, and similar for h[0]<<24.
> 
> I'm not aware of any compiler on any platform where it'll actually
> break, so your choice whether this is a real bug. I didn't check if
> similar issues exist elsewhere across musl.
> 
> I'm not subscribed to the list; I'll read the archives, but if you
> want a timely response, please cc me.

Thanks. It looks like the same thing happens in strstr. I'm almost
sure this (the strstr one) was reported in the past and I thought it
was fixed, but apparently not. I'll fix both of them now.

Rich