mailing list of musl libc
 help / color / mirror / code / Atom feed
* [musl] bug: integer overflow in memmem()
@ 2020-04-30 18:17 Alfred Agrell
  2020-04-30 20:31 ` Jeffrey Walton
  2020-04-30 23:55 ` Rich Felker
  0 siblings, 2 replies; 4+ messages in thread
From: Alfred Agrell @ 2020-04-30 18:17 UTC (permalink / raw)
  To: musl

To reproduce: Compile src/string/memmem.c with -fsanitize=undefined, then

int main()
{
char a[4] = { -1,-1,-1,-1 };
memmem(a, 4, a, 3);
memmem(a, 4, a, 4);
}

Expected result: No output

Actual (Ubuntu 18.04 x86_64, gcc 7.5.0, ):

memmem.c:15:20: runtime error: left shift of 255 by 24 places cannot be 
represented in type 'int'
memmem.c:16:20: runtime error: left shift of 255 by 24 places cannot be 
represented in type 'int'
memmem.c:24:20: runtime error: left shift of 255 by 24 places cannot be 
represented in type 'int'
memmem.c:25:20: runtime error: left shift of 255 by 24 places cannot be 
represented in type 'int'

C's integer promotion rules are fairly unintuitive for <<; it promotes 
unsigned small LHS to signed. To fix, change the two n[0]<<24 to 
(uint32_t)n[0]<<24, and similar for h[0]<<24.

I'm not aware of any compiler on any platform where it'll actually 
break, so your choice whether this is a real bug. I didn't check if 
similar issues exist elsewhere across musl.

I'm not subscribed to the list; I'll read the archives, but if you want 
a timely response, please cc me.

-- Alfred Agrell


^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2020-05-01  1:49 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-30 18:17 [musl] bug: integer overflow in memmem() Alfred Agrell
2020-04-30 20:31 ` Jeffrey Walton
2020-05-01  1:49   ` Rich Felker
2020-04-30 23:55 ` Rich Felker

Code repositories for project(s) associated with this public inbox

	https://git.vuxu.org/mirror/musl/

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).