[Bug libc/28082] New: argz_insert: usage of pointer value after end of lifetime due to call to realloc()

["andre.maroneze at cea dot fr" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=28082

            Bug ID: 28082
           Summary: argz_insert: usage of pointer value after end of
                    lifetime due to call to realloc()
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: minor
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: andre.maroneze at cea dot fr
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Created attachment 13557
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13557&action=edit
Possible patch for fixing UB in function __argz_insert

In file string/argz_insert.c, function __argz_insert, the value of pointer
*argz is used after a call to realloc(*argz, ...). This seems to be undefined
behavior, as indicated in C11:

> The value of a pointer to an object whose lifetime has ended is used.

> Section 6.2.4 §2 : The value of a pointer becomes indeterminate
> when the object it points to (or just past) reaches the end of
> its lifetime.

> 7.22.3 §1 : The lifetime of an allocated object extends from
> the allocation until the deallocation.

> 7.22.3.5 §2: The realloc function deallocates the old object
> pointed to by ptr […]

It happens in this section:

```
char *new_argz = realloc (*argz, new_argz_len);
if (new_argz)
  {
    before = new_argz + (before - *argz);
```

In practice, this is unlikely to cause crashes, but the presence of the UB
impacts static analysis tools and could lead to issues in the future.

Just in case, I'm attaching a possible patch to fix it: it suffices to compute
the pointer subtraction before calling realloc, and use the result when needed.
The patch has been computed w.r.t. the Git master branch, currently at commit
8235f9311bddbe4cf8ff1fa8f72f41aa77e27e00.

The issue has been found when running Frama-C on some code using argz_*
functions.

-- 
You are receiving this mail because:
You are on the CC list for the bug.