[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20260805133748.737719-1-matthias.goergens@gmail.com>
Date: Wed, 5 Aug 2026 21:37:47 +0800
From: Matthias Goergens <matthias.goergens@...il.com>
To: Szabolcs Nagy <nsz@...t70.net>
Cc: Matthias Goergens <matthias.goergens@...il.com>,
musl@...ts.openwall.com
Subject: Re: [PATCH] fix undefined pointer arithmetic in wcsrchr
Hi Szabolcs,
On Wed, Aug 05, 2026 at 01:49:36PM +0200, Szabolcs Nagy wrote:
> fixes a theoretical ub (unlikely to cause trouble in practice)
>
> how did you find this?
I have a bit of an obsession with undefined behaviour in C, and some
time on my hands at the moment due to paternity leave, so I went over
musl's string and wchar functions systematically looking for
out-of-bounds pointer arithmetic: forming pointers outside the object,
even without dereferencing them. wcsrchr's backwards loop was one of
the hits. I then confirmed it with an ASan-instrumented harness, which
flags the p>=s comparison once p has stepped before the array on a
miss.
The 2017 UB thread on this list was part of the motivation; that report
did not cover wcsrchr.
Thanks,
Matthias
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
