Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 07 Nov 2022 09:51:19 +0100
From: Simon Josefsson <simon@...efsson.org>
To: Rich Felker <dalias@...c.org>
Cc: bug-gsasl@....org, musl@...ts.openwall.com
Subject: Re: Behaviour of strverscmp(3)

Rich Felker <dalias@...c.org> writes:

> On Sun, Nov 06, 2022 at 06:18:22PM -0500, Dmitry Bogatov wrote:
>> Hello.
>> 
>> While trying to building gsasl statically with musl library as part of
>> Nixpkgs distribution, I noticed that test built from tests/version.c
>> fails when built with musl library. After a bit of troubleshooting, I
>> can pinpoint the reason -- different behaviour of "strverscmp" from
>> glibc and musl.
>> 
>> Example code:
>> 
>> #include <string.h>
>> #include <stdio.h>
>> 
>> int main()
>> {
>> 	int value = strverscmp("UNKNOWN", "2.2.0");
>> 	printf("%d\n", value);
>> 	return 0;
>> }
>> 
>> Under glibc value "35" is printed (positive), under musl value "-1" is
>> printed (negative). Not sure what is the correct solution for the
>> issue, so I cross-post into two lists.
>> 
>> For now I plan to patch-out this particular test. Thank you.
>
> It looks like we're neglecting to honor the exception case to "longer
> digit sequence is greater" when one of the sequences is degenerate (no
> digits).

Thanks for the report Dmitry (dropping cc because your email adressed
was reject by exim -- '550 restricted characters in address').

Right, I think this is a musl bug that gnulib doesn't detect and work
around.  I ran into it earlier on Alpine, but must have forgotten to
report it (or I found earlier bug reports about it).  Ignoring the
self-test failure is the right solution.  I believe strverscmp is a
glibc-specified interface, so musl should be compatible with it, right?

I'm inclined to add this test vector to the gnulib self-test for
strverscmp, so at least we know where the problem comes from.  Detecting
the issue and working around it seems like a lot of complexity (which is
a source for other bugs) and requires time and energy to support, for
what appears to be little gain, so I'm not sure it is worth it.

/Simon

Download attachment "signature.asc" of type "application/pgp-signature" (256 bytes)

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.