From: Samuel Thibault <samuel.thibault@ens-lyon.org>
To: Joseph Myers <joseph@codesourcery.com>
Cc: libc-alpha@sourceware.org
Subject: Re: Fix Hurd getcwd build with GCC >= 13
Date: Thu, 27 Apr 2023 01:29:39 +0200 [thread overview]
Message-ID: <20230426232939.thldgi44hctmadup@begin> (raw)
In-Reply-To: <18587337-7815-4056-ebd0-724df262d591@codesourcery.com>
Joseph Myers, le mer. 26 avril 2023 17:14:18 +0000, a ecrit:
> The build of glibc for i686-gnu has been failing for a while with GCC
> mainline / GCC 13:
>
> ../sysdeps/mach/hurd/getcwd.c: In function '__hurd_canonicalize_directory_name_internal':
> ../sysdeps/mach/hurd/getcwd.c:242:48: error: pointer 'file_name' may be used after 'realloc' [-Werror=use-after-free]
> 242 | file_namep = &buf[file_namep - file_name + size / 2];
> | ~~~~~~~~~~~^~~~~~~~~~~
> ../sysdeps/mach/hurd/getcwd.c:236:25: note: call to 'realloc' here
> 236 | buf = realloc (file_name, size);
> | ^~~~~~~~~~~~~~~~~~~~~~~~~
>
> This appears to be a genuine bug; fix by doing the subtraction before
> the reallocation makes the pointer invalid for arithmetic.
Well, it's actually not a genuine bug: the values of the file_namep
and file_name pointers are still coherent, so the subtraction is still
valid. But better please gcc 13 indeed, I have pushed it, thanks!
> Tested with build-many-glibcs.py for i686-gnu.
>
> diff --git a/sysdeps/mach/hurd/getcwd.c b/sysdeps/mach/hurd/getcwd.c
> index f24b35b380..cd3aedd9cd 100644
> --- a/sysdeps/mach/hurd/getcwd.c
> +++ b/sysdeps/mach/hurd/getcwd.c
> @@ -222,8 +222,9 @@ __hurd_canonicalize_directory_name_internal (file_t thisdir,
> found:
> {
> /* Prepend the directory name just discovered. */
> + size_t offset = file_namep - file_name;
>
> - if (file_namep - file_name < d->d_namlen + 1)
> + if (offset < d->d_namlen + 1)
> {
> if (orig_size > 0)
> {
> @@ -239,7 +240,7 @@ __hurd_canonicalize_directory_name_internal (file_t thisdir,
> free (file_name);
> return NULL;
> }
> - file_namep = &buf[file_namep - file_name + size / 2];
> + file_namep = &buf[offset + size / 2];
> file_name = buf;
> /* Move current contents up to the end of the buffer.
> This is guaranteed to be non-overlapping. */
>
> --
> Joseph S. Myers
> joseph@codesourcery.com
next prev parent reply other threads:[~2023-04-26 23:29 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-26 17:14 Joseph Myers
2023-04-26 23:29 ` Samuel Thibault [this message]
2023-04-26 23:34 ` Joseph Myers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230426232939.thldgi44hctmadup@begin \
--to=samuel.thibault@ens-lyon.org \
--cc=joseph@codesourcery.com \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).