From: Alfred Agrell <alfred@agrell.info>
To: musl@lists.openwall.com
Subject: [musl] bug: integer overflow in memmem()
Date: Thu, 30 Apr 2020 20:17:39 +0200 [thread overview]
Message-ID: <8756d18a-28ce-dda6-6300-24ae208351c2@agrell.info> (raw)
To reproduce: Compile src/string/memmem.c with -fsanitize=undefined, then
int main()
{
char a[4] = { -1,-1,-1,-1 };
memmem(a, 4, a, 3);
memmem(a, 4, a, 4);
}
Expected result: No output
Actual (Ubuntu 18.04 x86_64, gcc 7.5.0, ):
memmem.c:15:20: runtime error: left shift of 255 by 24 places cannot be
represented in type 'int'
memmem.c:16:20: runtime error: left shift of 255 by 24 places cannot be
represented in type 'int'
memmem.c:24:20: runtime error: left shift of 255 by 24 places cannot be
represented in type 'int'
memmem.c:25:20: runtime error: left shift of 255 by 24 places cannot be
represented in type 'int'
C's integer promotion rules are fairly unintuitive for <<; it promotes
unsigned small LHS to signed. To fix, change the two n[0]<<24 to
(uint32_t)n[0]<<24, and similar for h[0]<<24.
I'm not aware of any compiler on any platform where it'll actually
break, so your choice whether this is a real bug. I didn't check if
similar issues exist elsewhere across musl.
I'm not subscribed to the list; I'll read the archives, but if you want
a timely response, please cc me.
-- Alfred Agrell
next reply other threads:[~2020-04-30 18:30 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-30 18:17 Alfred Agrell [this message]
2020-04-30 20:31 ` Jeffrey Walton
2020-05-01 1:49 ` Rich Felker
2020-04-30 23:55 ` Rich Felker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8756d18a-28ce-dda6-6300-24ae208351c2@agrell.info \
--to=alfred@agrell.info \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).