public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
From: "fweimer at redhat dot com" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sourceware.org
Subject: [Bug stdio/26649] printf should handle non-normal x86 long double numbers gracefully
Date: Tue, 22 Sep 2020 17:15:29 +0000	[thread overview]
Message-ID: <bug-26649-131-WRsm5LldUE@http.sourceware.org/bugzilla/> (raw)
In-Reply-To: <bug-26649-131@http.sourceware.org/bugzilla/>

https://sourceware.org/bugzilla/show_bug.cgi?id=26649

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
   Target Milestone|---                         |2.33
         Resolution|---                         |FIXED

--- Comment #2 from Florian Weimer <fweimer at redhat dot com> ---
Fixed for glibc 2.33 via:

commit 681900d29683722b1cb0a8e565a0585846ec5a61
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Sep 22 19:07:48 2020 +0200

    x86: Harden printf against non-normal long double values (bug 26649)

    The behavior of isnan/__builtin_isnan on bit patterns that do not
    correspond to something that the CPU would produce from valid inputs
    is currently under-defined in the toolchain. (The GCC built-in and
    glibc disagree.)

    The isnan check in PRINTF_FP_FETCH in stdio-common/printf_fp.c
    assumes the GCC behavior that returns true for non-normal numbers
    which are not specified as NaN. (The glibc implementation returns
    false for such numbers.)

    At present, passing non-normal numbers to __mpn_extract_long_double
    causes this function to produce irregularly shaped multi-precision
    integers, triggering undefined behavior in __printf_fp_l.

    With GCC 10 and glibc 2.32, this behavior is not visible because
    __builtin_isnan is used, which avoids calling
    __mpn_extract_long_double in this case.  This commit updates the
    implementation of __mpn_extract_long_double so that regularly shaped
    multi-precision integers are produced in this case, avoiding
    undefined behavior in __printf_fp_l.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

  parent reply	other threads:[~2020-09-22 17:15 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-22 14:24 [Bug stdio/26649] New: " fweimer at redhat dot com
2020-09-22 14:25 ` [Bug stdio/26649] " fweimer at redhat dot com
2020-09-22 14:32 ` fweimer at redhat dot com
2020-09-22 17:15 ` fweimer at redhat dot com [this message]
2020-12-04 15:41 ` siddhesh at sourceware dot org
2020-12-06  8:21 ` carnil at debian dot org
2020-12-16  9:49 ` schwab@linux-m68k.org
2020-12-16 10:27 ` [Bug stdio/26649] printf should handle non-normal x86 long double numbers gracefully (CVE-2020-29573) fweimer at redhat dot com
2023-07-25 14:07 ` siddhesh at sourceware dot org

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=bug-26649-131-WRsm5LldUE@http.sourceware.org/bugzilla/ \
    --to=sourceware-bugzilla@sourceware.org \
    --cc=glibc-bugs@sourceware.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).