Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 7 Apr 2017 14:35:20 +0000
From: Pascal Cuoq <>
To: "" <>
Subject: Re: Undefined behavior in sprintf(dest, "%lld", -1LL)

> On 07 Apr 2017, at 16:26, Rich Felker <> wrote:
> On Fri, Apr 07, 2017 at 02:22:46PM +0000, Pascal Cuoq wrote:
>> I am running musl's implementation inside tis-interpreter, a C interpreter that detects a very wide palette of undefined behaviors.
>> ...
>> On the basis of this result, I would tentatively offer that the undefined behavior that tis-interpreter warns about is real and is caused by line 55 in vfprintf.c:
>> #define LLONG ULLONG
>> Because of this approach, when LLONG is passed to the function pop_arg(), the switch case at line 141 is taken:
>> break; case ULLONG: arg->i = va_arg(*ap, unsigned long long);
>> This causes UB by consuming a (negative) long long argument from a va_list with va_arg(..., unsigned long long).
> Does defining the ODD_TYPES macro fix the problem? My leaning is to
> just remove that #ifdef logic and always use the correct type with
> va_arg. All that was doing was saving a few bytes of code; the change
> should not affect performance.

Yes, this fixes it. I had to add the following line to vfprintf.c:

#include <stddef.h>

because the type ptrdiff_t is used at line 151 in this variation of the code.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.