[Bug libc/9914] possible signed integer overflow in libio/iogetdelim.c

[Bug libc/9914] possible signed integer overflow in libio/iogetdelim.c

[bugdal at aerifal dot cx]

http://sourceware.org/bugzilla/show_bug.cgi?id=9914

Rich Felker <bugdal at aerifal dot cx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bugdal at aerifal dot cx

--- Comment #1 from Rich Felker <bugdal at aerifal dot cx> 2011-10-24 15:18:34 UTC ---
Ping. This bug seems valid and has not been fixed. The fix is easy; change the
condition to (len >= SSIZE_MAX - cur_len)

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/9914] possible signed integer overflow in libio/iogetdelim.c

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=9914

Ulrich Drepper <drepper.fsp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #2 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-10-29 20:33:41 UTC ---
Wrong, gcc cannot and does not optimize the code away.  If it does it's  a
compiler problem.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/9914] possible signed integer overflow in libio/iogetdelim.c

[jakub at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=9914

Jakub Jelinek <jakub at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at redhat dot com

--- Comment #3 from Jakub Jelinek <jakub at redhat dot com> 2011-10-29 20:43:14 UTC ---
If it is testing whether cur_len + len + 1 overflowed from positive into
negative, then it is undefined behavior, because all the additions are
performed in signed _IO_ssize_t.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/9914] possible signed integer overflow in libio/iogetdelim.c

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=9914

--- Comment #4 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-10-29 21:17:08 UTC ---
(In reply to comment #3)
> If it is testing whether cur_len + len + 1 overflowed from positive into
> negative, then it is undefined behavior, because all the additions are
> performed in signed _IO_ssize_t.

The compiler cannot know that the variables are not negative.  Therefore the
test has to be emitted.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/9914] possible signed integer overflow in libio/iogetdelim.c

[bugdal at aerifal dot cx]

http://sourceware.org/bugzilla/show_bug.cgi?id=9914

Rich Felker <bugdal at aerifal dot cx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|INVALID                     |

--- Comment #5 from Rich Felker <bugdal at aerifal dot cx> 2011-10-29 21:19:49 UTC ---
Whether gcc optimizes this away probably depends on the compiler version and
options. I would have to read the code in greater detail to claim that this is
definitely the case, but it's likely that it's provable that cur_len and len
are always non-negative. Even if not, the code is invoking undefined behavior,
so there are other reasons the test could fail to work as expected. I already
submitted a fix; please apply or write your own better fix if you prefer.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/9914] possible signed integer overflow in libio/iogetdelim.c

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=9914

Ulrich Drepper <drepper.fsp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #6 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-10-29 21:37:11 UTC ---
Stop wasting people's time, there is nothing wrong.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/9914] possible signed integer overflow in libio/iogetdelim.c

[ldv at altlinux dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=9914

Dmitry V. Levin <ldv at altlinux dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ldv at altlinux dot org
         Resolution|FIXED                       |WONTFIX

--- Comment #7 from Dmitry V. Levin <ldv at altlinux dot org> 2011-10-29 22:11:43 UTC ---
(In reply to comment #4)
> The compiler cannot know that the variables are not negative.  Therefore the
> test has to be emitted.

If a human can know the fact that these variables are not negative, then a
smart compiler also can deduce this fact.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/9914] possible signed integer overflow in libio/iogetdelim.c

[bugdal at aerifal dot cx]

http://sourceware.org/bugzilla/show_bug.cgi?id=9914

Rich Felker <bugdal at aerifal dot cx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|WONTFIX                     |

--- Comment #8 from Rich Felker <bugdal at aerifal dot cx> 2011-10-30 05:37:52 UTC ---
I think it's going to take someone finding a version of gcc that can make the
optimization, and then publishing an attack that results in memory corruption
and possibly privilege elevation, to break through the brick wall known as
Drepper's ego and get this bug fixed...

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug stdio/9914] possible signed integer overflow in libio/iogetdelim.c

[jsm28 at gcc dot gnu.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=9914

Joseph Myers <jsm28 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|libc                        |stdio

--- Comment #9 from Joseph Myers <jsm28 at gcc dot gnu.org> 2012-02-21 01:29:46 UTC ---
FWIW I think we should fix signed integer overflows found in the code even if
we do not have any case where they cause problems in practice.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug stdio/9914] possible signed integer overflow in libio/iogetdelim.c

[bugdal at aerifal dot cx]

http://sourceware.org/bugzilla/show_bug.cgi?id=9914

--- Comment #10 from Rich Felker <bugdal at aerifal dot cx> 2012-03-17 20:34:55 UTC ---
Ping. Has this been fixed?

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug stdio/9914] possible signed integer overflow in libio/iogetdelim.c

[jsm28 at gcc dot gnu.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=9914

Joseph Myers <jsm28 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|drepper.fsp at gmail dot    |unassigned at sourceware
                   |com                         |dot org

--- Comment #11 from Joseph Myers <jsm28 at gcc dot gnu.org> 2012-03-18 14:22:11 UTC ---
>From source inspection it appears this issue is still present, and as per my
previous comment I think we should fix it.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug stdio/9914] possible signed integer overflow in libio/iogetdelim.c

[jsm28 at gcc dot gnu.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=9914

Joseph Myers <jsm28 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #12 from Joseph Myers <jsm28 at gcc dot gnu.org> 2012-09-04 11:27:02 UTC ---
Fixed for 2.17 by:

commit 60160d83a09c659d8d9338b210ff92be77cc87d5
Author: Joseph Myers <joseph@codesourcery.com>
Date:   Tue Sep 4 11:24:43 2012 +0000

    Fix iogetdelim.c (latent) integer overflow (bug 9914).

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug stdio/9914] possible signed integer overflow in libio/iogetdelim.c

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=9914

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.