Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 23 Apr 2020 11:34:26 +0000
From: Pascal Cuoq <cuoq@...st-in-soft.com>
To: "musl@...ts.openwall.com" <musl@...ts.openwall.com>
Subject: Re: Invalid pointer subtractions in __shlim and __shgetc

Hello again,

Rich Felker <dalias@...c.org> wrote:
> I think this patch may result in wrong error behavior on a trivial
> scanf that doesn't try to read anything. Instead it should be:
>
>        if (!f->rpos) __toread(f);
>        if (!f->rpos) goto input_fail;
>
> so that the error path is taken only on failure to enter read mode,
> not on EOF.

This has indeed fixed the invalid comparisons that were observed
from the tests I mentioned earlier, but a different test still has
the same problem.

As of commit 33338eb, the function wcstox does:
        f.rpos = f.rend = 0;
        f.buf = buf + 4;

(https://git.musl-libc.org/cgit/musl/tree/src/stdlib/wcstol.c?id=33338ebc853d37c80f0f236cc7a92cb0acc6aace#n38 )

It then passes the address of this f to shlim (line 45), causing the same invalid pointer subtraction f->buf - f->rpos that has already been discussed in this thread.

Best regards,

Pascal

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.