mailing list of musl libc
 help / color / mirror / code / Atom feed
From: Tamir Duberstein <>
Subject: [musl] undefined behavior in fread.c
Date: Fri, 24 Feb 2023 07:52:11 -0500	[thread overview]
Message-ID: <> (raw)

[-- Attachment #1: Type: text/plain, Size: 2038 bytes --]

Hello, it's me again! I previously reported undefined behavior in
getdelim.c in, and just
noticed this week that it has been fixed. Thank you!

After pulling in the latest changes, we now trip over UB in fread.c at on a
`fread(NULL, 1, 0, ...)` call. `dest` is `NULL`, and incrementing a null
pointer (even by zero) is UB. Here's the stack trace:

../../zircon/third_party/ulib/musl/src/stdio/fread.c:22:10: runtime error:
applying zero offset to null pointer
  #0    0x00008037bf602a6c in fread(void* restrict, size_t, size_t, FILE*
restrict) ../../zircon/third_party/ulib/musl/src/stdio/fread.c:22
  #1.2  0x0000421373b5f4ec in ubsan_GetStackTrace()
compiler-rt/lib/ubsan/ubsan_diag.cpp:41 <>+0x3d4ec
  #1.1  0x0000421373b5f4ec in MaybePrintStackTrace()
compiler-rt/lib/ubsan/ubsan_diag.cpp:51 <>+0x3d4ec
  #1    0x0000421373b5f4ec in ~ScopedReport()
compiler-rt/lib/ubsan/ubsan_diag.cpp:387 <>+0x3d4ec
  #2    0x0000421373b62684 in handlePointerOverflowImpl()
compiler-rt/lib/ubsan/ubsan_handlers.cpp:809 <>+0x40684
  #3    0x0000421373b6239c in compiler-rt/lib/ubsan/ubsan_handlers.cpp:815 <>+0x4039c
  #4    0x00008037bf602a6c in fread(void* restrict, size_t, size_t, FILE*
restrict) ../../zircon/third_party/ulib/musl/src/stdio/fread.c:22
  #5    0x00004347972c0934 in FT_Stream_Seek(FT_Stream, FT_ULong)
../../third_party/freetype2/src/base/ftstream.c:64 <>+0xf1934

I think instead of `nmemb = 0` on line 10 that should just return.

I've confirmed glibc does a similar check and avoids UB in this case. See;a=blob;f=libio/iofread.c;hb=HEAD#l35

Please CC me on responses as I am not a subscriber to this mailing list
per the guidance on

Thank you.

[-- Attachment #2: Type: text/html, Size: 2839 bytes --]

             reply	other threads:[~2023-02-24 12:52 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-02-24 12:52 Tamir Duberstein [this message]
2023-02-24 13:34 ` Rich Felker
2023-02-24 13:53   ` Jₑₙₛ Gustedt
2023-02-24 13:55   ` NRK
2023-02-24 14:07     ` Rich Felker
2023-02-24 14:17       ` NRK
2023-02-24 14:42         ` Tamir Duberstein
2023-02-24 15:13           ` NRK
2023-02-24 16:12             ` Tamir Duberstein
2023-02-24 16:40               ` Jₑₙₛ Gustedt
2023-02-24 16:42                 ` Tamir Duberstein
2023-02-24 17:00                   ` Jₑₙₛ Gustedt
2023-02-24 17:07                     ` enh
2023-02-24 17:32                       ` Tamir Duberstein
2023-02-24 16:42                 ` enh
2023-02-24 20:07                 ` Rich Felker

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='' \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).