Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 24 Feb 2023 08:34:14 -0500
From: Rich Felker <>
To: Tamir Duberstein <>
Subject: Re: undefined behavior in fread.c

On Fri, Feb 24, 2023 at 07:52:11AM -0500, Tamir Duberstein wrote:
> Hello, it's me again! I previously reported undefined behavior in
> getdelim.c in, and just
> noticed this week that it has been fixed. Thank you!
> After pulling in the latest changes, we now trip over UB in fread.c at
> on a
> `fread(NULL, 1, 0, ...)` call. `dest` is `NULL`, and incrementing a null
> pointer (even by zero) is UB. Here's the stack trace:
> .../../zircon/third_party/ulib/musl/src/stdio/fread.c:22:10: runtime error:
> applying zero offset to null pointer
>   #0    0x00008037bf602a6c in fread(void* restrict, size_t, size_t, FILE*
> restrict) ../../zircon/third_party/ulib/musl/src/stdio/fread.c:22
> <>+0x168a6c
>   #1.2  0x0000421373b5f4ec in ubsan_GetStackTrace()
> compiler-rt/lib/ubsan/ubsan_diag.cpp:41 <>+0x3d4ec
>   #1.1  0x0000421373b5f4ec in MaybePrintStackTrace()
> compiler-rt/lib/ubsan/ubsan_diag.cpp:51 <>+0x3d4ec
>   #1    0x0000421373b5f4ec in ~ScopedReport()
> compiler-rt/lib/ubsan/ubsan_diag.cpp:387 <>+0x3d4ec
>   #2    0x0000421373b62684 in handlePointerOverflowImpl()
> compiler-rt/lib/ubsan/ubsan_handlers.cpp:809 <>+0x40684
>   #3    0x0000421373b6239c in compiler-rt/lib/ubsan/ubsan_handlers.cpp:815 <
>   #4    0x00008037bf602a6c in fread(void* restrict, size_t, size_t, FILE*
> restrict) ../../zircon/third_party/ulib/musl/src/stdio/fread.c:22
> <>+0x168a6c
>   #5    0x00004347972c0934 in FT_Stream_Seek(FT_Stream, FT_ULong)
> .../../third_party/freetype2/src/base/ftstream.c:64 <>+0xf1934
> I think instead of `nmemb = 0` on line 10 that should just return.
> I've confirmed glibc does a similar check and avoids UB in this case. See
> and
> Please CC me on responses as I am not a subscriber to this mailing list
> per the guidance on

Is there any indication that passing NULL as the first argument to
fread is not itself undefined? Normally I would expect that to be the


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.