[-- Attachment #1: Type: text/plain, Size: 1 bytes --] [-- Attachment #2: 0001-reallocarray-overflow-check-cast-to-size_t.patch --] [-- Type: text/x-patch, Size: 638 bytes --] From 04e3caa580cfe501ad00d85d63040de329962823 Mon Sep 17 00:00:00 2001 From: David Carlier <devnexen@gmail.com> Date: Mon, 10 May 2021 20:45:12 +0100 Subject: [PATCH] reallocarray overflow check cast to size_t --- src/malloc/reallocarray.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/malloc/reallocarray.c b/src/malloc/reallocarray.c index 4a6ebe46..2556c917 100644 --- a/src/malloc/reallocarray.c +++ b/src/malloc/reallocarray.c @@ -4,7 +4,7 @@ void *reallocarray(void *ptr, size_t m, size_t n) { - if (n && m > -1 / n) { + if (n && m > (size_t)-1 / n) { errno = ENOMEM; return 0; } -- 2.20.1
* David CARLIER <devnexen@gmail.com> [2021-05-10 20:48:26 +0100]: > From 04e3caa580cfe501ad00d85d63040de329962823 Mon Sep 17 00:00:00 2001 > From: David Carlier <devnexen@gmail.com> > Date: Mon, 10 May 2021 20:45:12 +0100 > Subject: [PATCH] reallocarray overflow check cast to size_t > > --- > src/malloc/reallocarray.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/src/malloc/reallocarray.c b/src/malloc/reallocarray.c > index 4a6ebe46..2556c917 100644 > --- a/src/malloc/reallocarray.c > +++ b/src/malloc/reallocarray.c > @@ -4,7 +4,7 @@ > > void *reallocarray(void *ptr, size_t m, size_t n) > { > - if (n && m > -1 / n) { > + if (n && m > (size_t)-1 / n) { you need to explain this change more i think. the usual arithmetic conversion rules of c already convert both operands of / to size_t, unless size_t has lower conversion rank than signed int, but such a system would have problems because size_t was always promoted to int so you would need a lot more casts in musl (and other software) to avoid signed int overflow and negative arithmetics. > errno = ENOMEM; > return 0; > } > -- > 2.20.1 >
On Tue, May 11, 2021 at 09:33:06AM +0200, Szabolcs Nagy wrote:
> * David CARLIER <devnexen@gmail.com> [2021-05-10 20:48:26 +0100]:
> > From 04e3caa580cfe501ad00d85d63040de329962823 Mon Sep 17 00:00:00 2001
> > From: David Carlier <devnexen@gmail.com>
> > Date: Mon, 10 May 2021 20:45:12 +0100
> > Subject: [PATCH] reallocarray overflow check cast to size_t
> >
> > ---
> > src/malloc/reallocarray.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/src/malloc/reallocarray.c b/src/malloc/reallocarray.c
> > index 4a6ebe46..2556c917 100644
> > --- a/src/malloc/reallocarray.c
> > +++ b/src/malloc/reallocarray.c
> > @@ -4,7 +4,7 @@
> >
> > void *reallocarray(void *ptr, size_t m, size_t n)
> > {
> > - if (n && m > -1 / n) {
> > + if (n && m > (size_t)-1 / n) {
>
> you need to explain this change more i think.
>
> the usual arithmetic conversion rules of c already convert both
> operands of / to size_t, unless size_t has lower conversion rank
> than signed int, but such a system would have problems because
> size_t was always promoted to int so you would need a lot more
> casts in musl (and other software) to avoid signed int overflow
> and negative arithmetics.
I think the idea was just to make it explicit, but generally casting
is discouraged in musl. The corresponding code in calloc has a cast
but it's a historical artifact and contrary to the coding style used
throughout most of the source.
Rich