From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org
X-Spam-Level: 
X-Spam-Status: No, score=-3.3 required=5.0 tests=MAILING_LIST_MULTI,
	RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,
	T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4
Received: (qmail 4183 invoked from network); 1 Dec 2023 15:52:43 -0000
Received: from second.openwall.net (193.110.157.125)
  by inbox.vuxu.org with ESMTPUTF8; 1 Dec 2023 15:52:43 -0000
Received: (qmail 5479 invoked by uid 550); 1 Dec 2023 15:52:36 -0000
Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm
Precedence: bulk
List-Post: <mailto:musl@lists.openwall.com>
List-Help: <mailto:musl-help@lists.openwall.com>
List-Unsubscribe: <mailto:musl-unsubscribe@lists.openwall.com>
List-Subscribe: <mailto:musl-subscribe@lists.openwall.com>
List-ID: <musl.lists.openwall.com>
Reply-To: musl@lists.openwall.com
Received: (qmail 5445 invoked from network); 1 Dec 2023 15:52:35 -0000
Date: Fri, 1 Dec 2023 10:52:40 -0500
From: Rich Felker <dalias@libc.org>
To: Anuraag Agrawal <anuraaga@gmail.com>
Cc: musl@lists.openwall.com
Message-ID: <20231201155240.GB4163@brightrain.aerifal.cx>
References: <CAOWvS+0oOjLue4S=E1ua7oMMe-EZn_zaU3RvYDMuSGNxDP2isw@mail.gmail.com>
 <CAOWvS+0cZ03MsaRyOWWjZ_Ut1Lj+BVQjyRaEQ+ozgPSBTNyKRQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <CAOWvS+0cZ03MsaRyOWWjZ_Ut1Lj+BVQjyRaEQ+ozgPSBTNyKRQ@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Subject: Re: [musl] Re: Large overflow in __intscan ignored

On Fri, Dec 01, 2023 at 02:14:03PM +0900, Anuraag Agrawal wrote:
> Oops, sorry I should have mentioned, the inputs I am working with that do
> not set errno are
> 
> 999999999999999999999
> 1000000000000000000000
> 4790999999999999999999999999999999999999999999999999999999999999999999999999999999999999
> 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
> 
> For context, they come from test cases in libpg_query
> 
> https://github.com/pganalyze/libpg_query/blob/15-latest/test/scan_tests.c#L30
> 
> On Fri, Dec 1, 2023 at 2:08 PM Anuraag Agrawal <anuraaga@gmail.com> wrote:
> 
> > Currently, __intscan, used by functions like strtol, does not seem to
> > check for overflow during multiplication.
> >
> > https://git.musl-libc.org/cgit/musl/tree/src/internal/intscan.c#n69
> >
> > It at the end checks against the limit, e.g. the size of a long
> >
> > https://git.musl-libc.org/cgit/musl/tree/src/internal/intscan.c#n90
> >
> > However, if the value overflows and ends up in the range of the limit,
> > errno will not be set. It seems that each multiplication operation needs to
> > be checking for overflow and return errno if it ever happens.

Can you clarify whether you are reporting a bug in musl or trying to
reuse this code and possibly making breaking changes to your copy? I
cannot reproduce any problem with your test cases. They all correctly
report ERANGE. Checked for strtol, strtoll, and strtoull.

Rich