[Bug build/28439] New: -Wformat-overflow in resolv/res_query.c

[Bug build/28439] New: -Wformat-overflow in resolv/res_query.c

[msebor at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=28439

            Bug ID: 28439
           Summary: -Wformat-overflow in resolv/res_query.c
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: build
          Assignee: unassigned at sourceware dot org
          Reporter: msebor at gmail dot com
                CC: carlos at redhat dot com
  Target Milestone: ---

A GCC 12 enhancement (still under review) to the optimizer has improved GCC's
ability to extract and propagate range information from strlen() expressions. 
The improvement lets GCC infer constraints on strlen() results from subsequent
expressions involving lengths of different strings, like in the following code
in resolv/res_query.c:

                n = strlen(name);
                d = strlen(domain);
                if (n + d + 1 >= MAXDNAME) {
                        RES_SET_H_ERRNO(statp, NO_RECOVERY);
                        return (-1);
                }
                sprintf (nbuf, "%s.%s",name, domain);

Here, GCC determines from the if condition that n and d are each constrained to
less than MAXDNAME, but because it can't express their relationship in the
inequality, the constraint isn't tight enough to rule out that their sum might
exceed MAXDNAME.  This in turns triggers the warning below:

res_query.c: In function ‘__res_context_querydomain’:
res_query.c:613:35: warning: ‘%s’ directive writing up to 1023 bytes into a
region of size between 1 and 1024 [-Wformat-overflow=]
  613 |                 sprintf(nbuf, "%s.%s", name, domain);
      |                                   ^~
res_query.c:613:17: note: ‘sprintf’ output between 2 and 2048 bytes into a
destination of size 1025
  613 |                 sprintf(nbuf, "%s.%s", name, domain);
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


This code triggered a similar false positive in the past.  It was reported in
GCC bug 91567 and quickly fixed there.  In this case, however, a fix in GCC
isn't feasible.  Everything is working as designed, but the better range
information exposed by the enhancement isn't sufficient to avoid the warning. 
The warning can be easily avoided in Glibc either by #pragma GCC diagnostic or
by changing the code to avoid sprintf as shown below:

index 75b0e5f2f7..31ab1db60b 100644
--- a/resolv/res_query.c
+++ b/resolv/res_query.c
@@ -610,7 +610,9 @@ __res_context_querydomain (struct resolv_context *ctx,
                        RES_SET_H_ERRNO(statp, NO_RECOVERY);
                        return (-1);
                }
-               sprintf(nbuf, "%s.%s", name, domain);
+               strcpy (nbuf, name);
+               nbuf[n] = '.';
+               strcpy (nbuf + n + 1, domain);
        }
        return __res_context_query (ctx, longname, class, type, answer,
                                    anslen, answerp, answerp2, nanswerp2,

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug build/28439] -Wformat-overflow in resolv/res_query.c

[msebor at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=28439

--- Comment #1 from Martin Sebor <msebor at gmail dot com> ---
Patch: https://sourceware.org/pipermail/libc-alpha/2021-October/131791.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug build/28439] -Wformat-overflow in resolv/res_query.c

[msebor at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=28439

Martin Sebor <msebor at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #2 from Martin Sebor <msebor at gmail dot com> ---
Fixed in https://sourceware.org/pipermail/glibc-cvs/2021q4/075293.html.

-- 
You are receiving this mail because:
You are on the CC list for the bug.