mailing list of musl libc
 help / color / mirror / code / Atom feed
From: Rich Felker <dalias@libc.org>
To: musl@lists.openwall.com
Subject: Re: [musl] bug: integer overflow in memmem()
Date: Thu, 30 Apr 2020 21:49:23 -0400	[thread overview]
Message-ID: <20200501014923.GL21576@brightrain.aerifal.cx> (raw)
In-Reply-To: <CAH8yC8nQ3hBv0GAsHqdBEGV1jKpZtK+h3DFgtym8kdMgidxupw@mail.gmail.com>

On Thu, Apr 30, 2020 at 04:31:11PM -0400, Jeffrey Walton wrote:
> On Thu, Apr 30, 2020 at 2:30 PM Alfred Agrell <alfred@agrell.info> wrote:
> >
> > To reproduce: Compile src/string/memmem.c with -fsanitize=undefined, then
> >
> > int main()
> > {
> >   char a[4] = { -1,-1,-1,-1 };
> >   memmem(a, 4, a, 3);
> >   memmem(a, 4, a, 4);
> > }
> >
> > Expected result: No output
> >
> > Actual (Ubuntu 18.04 x86_64, gcc 7.5.0, ):
> >
> > memmem.c:15:20: runtime error: left shift of 255 by 24 places cannot be
> > represented in type 'int'
> > memmem.c:16:20: runtime error: left shift of 255 by 24 places cannot be
> > represented in type 'int'
> > memmem.c:24:20: runtime error: left shift of 255 by 24 places cannot be
> > represented in type 'int'
> > memmem.c:25:20: runtime error: left shift of 255 by 24 places cannot be
> > represented in type 'int'
> >...
> >
> > I'm not aware of any compiler on any platform where it'll actually
> > break, so your choice whether this is a real bug. I didn't check if
> > similar issues exist elsewhere across musl.
> 
> Try Intel ICC. It is ruthless and removes undefined behavior every
> chance it gets. It can usually break a program with UB that GCC, Clang
> and MSVC compile OK.

Indeed, ICC can even break programs that don't have UB. :-)

Cheap shots at ICC aside, I don't think it will break this because,
assuming no LTO (and thus external calls as compiler barriers), it
would have to generate suboptimal code with explicit overflow check of
some sort to do the wrong thing here. But in any case it's desirable
to be able to build with UBSan or similar tooling that actively
catches UB, so I'm fixing it.

For the record, I found where Szabolcs Nagy reported this in 2018, and
I think others reported it as well. I really should have fixed this a
long time ago.

Rich

  reply	other threads:[~2020-05-01  1:49 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-30 18:17 Alfred Agrell
2020-04-30 20:31 ` Jeffrey Walton
2020-05-01  1:49   ` Rich Felker [this message]
2020-04-30 23:55 ` Rich Felker

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200501014923.GL21576@brightrain.aerifal.cx \
    --to=dalias@libc.org \
    --cc=musl@lists.openwall.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.vuxu.org/mirror/musl/

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).