[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 17 Sep 2016 01:17:40 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Cc: Alexander Cherepanov <ch3root@...nwall.com>
Subject: [PATCH] [RFC] fix integer overflows and uncaught EOVERFLOW in printf
This patch expands on issues raised by Alexander Cherepanov earlier
this year with some concrete fixes. I'm not terribly concerned about
what happens when the format string itself contains out-of-range
numbers (although it would be nice to handle that right), but it is
important to handle correctly cases where the data being printed (e.g.
long strings) would cause the total length to overflow INT_MAX, or
where it would cause internal overflows.
This patch:
1. Returns with an error as soon as EOVERFLOW conditions are detected,
rather than continuing to produce output.
2. Catches overflows where the format string itself is longer than
INT_MAX (only possible on 64-bit archs).
3. Catches %s argument strings longer than INT_MAX (likewise).
4. Catches cases where adding a prefix length to a precision would
overflow.
5. Correctly handles width specifiers that overflow (always an error)
and precision specifiers that overflow (error for everything but
strings; for strings they're equivalent to no precision/no limit).
Checking wide strings and floating point conversions for overflows
remains to be done.
As discussed before, none of these overflows are presently dangerous,
but they do lead to mildly wrong results in the relevant corner cases
and really should be fixed.
Rich
View attachment "printf-int-overflows.diff" of type "text/plain" (4336 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
