Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 19 Jun 2014 01:43:50 +0000 (UTC)
From: Clément Vasseur <clement.vasseur@...il.com>
To: musl@...ts.openwall.com
Subject: Re: uninitialized memory access in memmem()

On 2014-06-19, Rich Felker <dalias@...c.org> wrote:
> On Wed, Jun 18, 2014 at 06:20:33PM +0000, Clément Vasseur wrote:
>> Hello,
>> 
>> I found a case where memmem() returns 0 where it should not:
>> 
>> $ cat test-memmem.c
>> #define _GNU_SOURCE
>> #include <string.h>
>> #include <assert.h>
>> 
>> #define DATA 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10
>> 
>> int main(void)
>> {
>>     const unsigned char haystack[] = { DATA };
>>     const unsigned char needle[] = { DATA };
>>     assert(memmem(haystack, sizeof haystack, needle, sizeof needle));
>> }
>> 
>> $ musl-gcc test-memmem.c && ./a.out
>> Assertion failed: memmem(haystack, sizeof haystack, needle, sizeof needle) (test-memmem.c: main: 11)
>> Aborted
>> 
>> Valgrind says a conditional jump or move depends on uninitalized value
>> in twoway_memmem(). The code is quite complicated so I have not tried to
>> track it down any further.
>
> Can you provide more details? musl version? gcc version? arch? I can't
> reproduce this error in master with gcc 4.7.3/i386.

I use master (7c73cac) with gcc 4.6.1/x86_64.

I have another pattern which fails with gcc 4.8.3/arm. Looks like you
might reproduce this one on your 32-bit arch:

#define DATA 0x50, 0x17, 0x8a, 0xf3, 0x55, 0x67, 0x58, 0xdf

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.