Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 10 Apr 2017 09:31:48 +0000
From: Pascal Cuoq <>
To: "" <>
Subject: *scanf, wrong types in va_arg, and strict aliasing

Hello again,

the scanf implementation does the same thing as the printf implementation, in vfscanf.c, line 110:

This line is eventually reached, for instance, for the snippet:

int n; sscanf("0", "%d", &n);

And the argument being consumed has type int*. This is not a case that allows.

Besides, since I am reviewing this file, and since I was originally interested in analyzing it for strict aliasing violations (although the analyzer is not ready to handle this file), I should point out the function store_int at line 22 and the way it is used at line 146:

This will not go down well with the strict aliasing analyzer, when it is finally ready for this sort of code. And indeed, compiling the previous scanf snippet together with musl's source code while enabling link-time optimization could plausibly produce non-working binary code because of the type-based alias analysis.

For this latter problem, use of types with the may_alias attribute will fix it for GCC and Clang. For the problem with va_arg, I do not see any easy way out. It might be possible to write a longer version that a modern compiler miraculously recognizes as doing the same thing over and over and folds back into a single sequence of instructions, but without having tried it yet, this seems a bit far-fetched.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.