From: Tamir Duberstein <tamird@google.com>
To: musl@lists.openwall.com
Subject: [musl] undefined behavior in fread.c
Date: Fri, 24 Feb 2023 07:52:11 -0500 [thread overview]
Message-ID: <CAK-_uh7=5Ea3pESgEiDjWHifpe+x3w3-ccpDupz6d9ksyGqXLA@mail.gmail.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 2038 bytes --]
Hello, it's me again! I previously reported undefined behavior in
getdelim.c in https://www.openwall.com/lists/musl/2021/08/30/1, and just
noticed this week that it has been fixed. Thank you!
After pulling in the latest changes, we now trip over UB in fread.c at
https://git.musl-libc.org/cgit/musl/tree/src/stdio/fread.c#n21 on a
`fread(NULL, 1, 0, ...)` call. `dest` is `NULL`, and incrementing a null
pointer (even by zero) is UB. Here's the stack trace:
../../zircon/third_party/ulib/musl/src/stdio/fread.c:22:10: runtime error:
applying zero offset to null pointer
#0 0x00008037bf602a6c in fread(void* restrict, size_t, size_t, FILE*
restrict) ../../zircon/third_party/ulib/musl/src/stdio/fread.c:22
<libr.so>+0x168a6c
#1.2 0x0000421373b5f4ec in ubsan_GetStackTrace()
compiler-rt/lib/ubsan/ubsan_diag.cpp:41 <libclang_rt.asan.so>+0x3d4ec
#1.1 0x0000421373b5f4ec in MaybePrintStackTrace()
compiler-rt/lib/ubsan/ubsan_diag.cpp:51 <libclang_rt.asan.so>+0x3d4ec
#1 0x0000421373b5f4ec in ~ScopedReport()
compiler-rt/lib/ubsan/ubsan_diag.cpp:387 <libclang_rt.asan.so>+0x3d4ec
#2 0x0000421373b62684 in handlePointerOverflowImpl()
compiler-rt/lib/ubsan/ubsan_handlers.cpp:809 <libclang_rt.asan.so>+0x40684
#3 0x0000421373b6239c in compiler-rt/lib/ubsan/ubsan_handlers.cpp:815 <
libclang_rt.asan.so>+0x4039c
#4 0x00008037bf602a6c in fread(void* restrict, size_t, size_t, FILE*
restrict) ../../zircon/third_party/ulib/musl/src/stdio/fread.c:22
<libc.so>+0x168a6c
#5 0x00004347972c0934 in FT_Stream_Seek(FT_Stream, FT_ULong)
../../third_party/freetype2/src/base/ftstream.c:64 <libfreetype2.so>+0xf1934
I think instead of `nmemb = 0` on line 10 that should just return.
I've confirmed glibc does a similar check and avoids UB in this case. See
https://sourceware.org/git/?p=glibc.git;a=blob;f=libio/iofread.c;hb=HEAD#l35
and https://godbolt.org/z/cYc9rG1ea.
Please CC me on responses as I am not a subscriber to this mailing list
per the guidance on https://musl.libc.org/support.html.
Thank you.
Tamir
[-- Attachment #2: Type: text/html, Size: 2839 bytes --]
next reply other threads:[~2023-02-24 12:52 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-24 12:52 Tamir Duberstein [this message]
2023-02-24 13:34 ` Rich Felker
2023-02-24 13:53 ` Jₑₙₛ Gustedt
2023-02-24 13:55 ` NRK
2023-02-24 14:07 ` Rich Felker
2023-02-24 14:17 ` NRK
2023-02-24 14:42 ` Tamir Duberstein
2023-02-24 15:13 ` NRK
2023-02-24 16:12 ` Tamir Duberstein
2023-02-24 16:40 ` Jₑₙₛ Gustedt
2023-02-24 16:42 ` Tamir Duberstein
2023-02-24 17:00 ` Jₑₙₛ Gustedt
2023-02-24 17:07 ` enh
2023-02-24 17:32 ` Tamir Duberstein
2023-02-24 16:42 ` enh
2023-02-24 20:07 ` Rich Felker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAK-_uh7=5Ea3pESgEiDjWHifpe+x3w3-ccpDupz6d9ksyGqXLA@mail.gmail.com' \
--to=tamird@google.com \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).