Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 7 Apr 2017 14:35:20 +0000
From: Pascal Cuoq <cuoq@...st-in-soft.com>
To: "musl@...ts.openwall.com" <musl@...ts.openwall.com>
Subject: Re: Undefined behavior in sprintf(dest, "%lld", -1LL)


> On 07 Apr 2017, at 16:26, Rich Felker <dalias@...c.org> wrote:
> 
> On Fri, Apr 07, 2017 at 02:22:46PM +0000, Pascal Cuoq wrote:
>> I am running musl's implementation inside tis-interpreter, a C interpreter that detects a very wide palette of undefined behaviors.
>> 
>> ...
>> 
>> On the basis of this result, I would tentatively offer that the undefined behavior that tis-interpreter warns about is real and is caused by line 55 in vfprintf.c:
>> 
>> #define LLONG ULLONG
>> 
>> Because of this approach, when LLONG is passed to the function pop_arg(), the switch case at line 141 is taken:
>> 
>> break; case ULLONG: arg->i = va_arg(*ap, unsigned long long);
>> 
>> This causes UB by consuming a (negative) long long argument from a va_list with va_arg(..., unsigned long long).
> 
> Does defining the ODD_TYPES macro fix the problem? My leaning is to
> just remove that #ifdef logic and always use the correct type with
> va_arg. All that was doing was saving a few bytes of code; the change
> should not affect performance.

Yes, this fixes it. I had to add the following line to vfprintf.c:

#include <stddef.h>

because the type ptrdiff_t is used at line 151 in this variation of the code.

Thanks!

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.