* glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) @ 2022-07-29 15:26 Carlos O'Donell 2022-07-29 15:43 ` Sunil Pandey ` (3 more replies) 0 siblings, 4 replies; 10+ messages in thread From: Carlos O'Donell @ 2022-07-29 15:26 UTC (permalink / raw) To: libc-alpha Just posting here for the record that I see a glibc 2.36 build failure with Fedora 36 and gcc 12. localealias.c: In function ‘read_alias_file’: localealias.c:335:56: error: pointer may be used after ‘realloc’ [-Werror=use-after-free] 335 | map[i].alias += new_pool - string_space; | ~~~~~~~~~^~~~~~~~~~~~~~ localealias.c:325:49: note: call to ‘realloc’ here 325 | char *new_pool = (char *) realloc (string_space, new_size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors I'm going to review this quickly before we make the glibc release. -- Cheers, Carlos. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) 2022-07-29 15:26 glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) Carlos O'Donell @ 2022-07-29 15:43 ` Sunil Pandey 2022-07-29 16:08 ` Sunil Pandey 2022-07-29 15:52 ` Mark Wielaard ` (2 subsequent siblings) 3 siblings, 1 reply; 10+ messages in thread From: Sunil Pandey @ 2022-07-29 15:43 UTC (permalink / raw) To: Carlos O'Donell; +Cc: libc-alpha On Fri, Jul 29, 2022 at 8:26 AM Carlos O'Donell via Libc-alpha <libc-alpha@sourceware.org> wrote: > > Just posting here for the record that I see a glibc 2.36 build failure > with Fedora 36 and gcc 12. > > localealias.c: In function ‘read_alias_file’: > localealias.c:335:56: error: pointer may be used after ‘realloc’ [-Werror=use-after-free] > 335 | map[i].alias += new_pool - string_space; > | ~~~~~~~~~^~~~~~~~~~~~~~ > localealias.c:325:49: note: call to ‘realloc’ here > 325 | char *new_pool = (char *) realloc (string_space, new_size); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > cc1: all warnings being treated as errors > > I'm going to review this quickly before we make the glibc release. > > -- > Cheers, > Carlos. > I am getting these 2 wide string test failures on my SKX server. FAIL: wcsmbs/test-c8rtomb (Not reproducible) FAIL: wcsmbs/test-mbrtoc8 $ wcsmbs/test-mbrtoc8 test-mbrtoc8.c:477: numeric comparison failure left: 2 (0x2); from: mbrtoc8 (buf, mbs, 1, &s) right: 1 (0x1); from: (size_t) 1 test-mbrtoc8.c:479: numeric comparison failure left: 0 (0x0); from: buf[0] right: 195 (0xc3); from: 0xC3 test-mbrtoc8.c:481: numeric comparison failure left: 204 (0xcc); from: buf[0] right: 138 (0x8a); from: 0x8A test-mbrtoc8.c:483: numeric comparison failure left: 132 (0x84); from: buf[0] right: 204 (0xcc); from: 0xCC test-mbrtoc8.c:484: numeric comparison failure left: 0 (0x0); from: mbrtoc8 (buf, mbs, 1, &s) right: 18446744073709551613 (0xfffffffffffffffd); from: (size_t) -3 test-mbrtoc8.c:485: numeric comparison failure left: 0 (0x0); from: buf[0] right: 132 (0x84); from: 0x84 test-mbrtoc8.c:516: numeric comparison failure left: 2 (0x2); from: mbrtoc8 (buf, mbs, 1, &s) right: 1 (0x1); from: (size_t) 1 test-mbrtoc8.c:518: numeric comparison failure left: 0 (0x0); from: buf[0] right: 195 (0xc3); from: 0xC3 test-mbrtoc8.c:520: numeric comparison failure left: 204 (0xcc); from: buf[0] right: 170 (0xaa); from: 0xAA test-mbrtoc8.c:522: numeric comparison failure left: 140 (0x8c); from: buf[0] right: 204 (0xcc); from: 0xCC test-mbrtoc8.c:523: numeric comparison failure left: 0 (0x0); from: mbrtoc8 (buf, mbs, 1, &s) right: 18446744073709551613 (0xfffffffffffffffd); from: (size_t) -3 test-mbrtoc8.c:524: numeric comparison failure left: 0 (0x0); from: buf[0] right: 140 (0x8c); from: 0x8C error: 12 test failures ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) 2022-07-29 15:43 ` Sunil Pandey @ 2022-07-29 16:08 ` Sunil Pandey 2022-07-29 17:46 ` Sunil Pandey 0 siblings, 1 reply; 10+ messages in thread From: Sunil Pandey @ 2022-07-29 16:08 UTC (permalink / raw) To: Carlos O'Donell, tom; +Cc: libc-alpha On Fri, Jul 29, 2022 at 8:43 AM Sunil Pandey <skpgkp2@gmail.com> wrote: > > On Fri, Jul 29, 2022 at 8:26 AM Carlos O'Donell via Libc-alpha > <libc-alpha@sourceware.org> wrote: > > > > Just posting here for the record that I see a glibc 2.36 build failure > > with Fedora 36 and gcc 12. > > > > localealias.c: In function ‘read_alias_file’: > > localealias.c:335:56: error: pointer may be used after ‘realloc’ [-Werror=use-after-free] > > 335 | map[i].alias += new_pool - string_space; > > | ~~~~~~~~~^~~~~~~~~~~~~~ > > localealias.c:325:49: note: call to ‘realloc’ here > > 325 | char *new_pool = (char *) realloc (string_space, new_size); > > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > cc1: all warnings being treated as errors > > > > I'm going to review this quickly before we make the glibc release. > > > > -- > > Cheers, > > Carlos. > > > > I am getting these 2 wide string test failures on my SKX server. > > FAIL: wcsmbs/test-c8rtomb (Not reproducible) > > FAIL: wcsmbs/test-mbrtoc8 > > $ wcsmbs/test-mbrtoc8 > test-mbrtoc8.c:477: numeric comparison failure > left: 2 (0x2); from: mbrtoc8 (buf, mbs, 1, &s) > right: 1 (0x1); from: (size_t) 1 > test-mbrtoc8.c:479: numeric comparison failure > left: 0 (0x0); from: buf[0] > right: 195 (0xc3); from: 0xC3 > test-mbrtoc8.c:481: numeric comparison failure > left: 204 (0xcc); from: buf[0] > right: 138 (0x8a); from: 0x8A > test-mbrtoc8.c:483: numeric comparison failure > left: 132 (0x84); from: buf[0] > right: 204 (0xcc); from: 0xCC > test-mbrtoc8.c:484: numeric comparison failure > left: 0 (0x0); from: mbrtoc8 (buf, mbs, 1, &s) > right: 18446744073709551613 (0xfffffffffffffffd); from: (size_t) -3 > test-mbrtoc8.c:485: numeric comparison failure > left: 0 (0x0); from: buf[0] > right: 132 (0x84); from: 0x84 > test-mbrtoc8.c:516: numeric comparison failure > left: 2 (0x2); from: mbrtoc8 (buf, mbs, 1, &s) > right: 1 (0x1); from: (size_t) 1 > test-mbrtoc8.c:518: numeric comparison failure > left: 0 (0x0); from: buf[0] > right: 195 (0xc3); from: 0xC3 > test-mbrtoc8.c:520: numeric comparison failure > left: 204 (0xcc); from: buf[0] > right: 170 (0xaa); from: 0xAA > test-mbrtoc8.c:522: numeric comparison failure > left: 140 (0x8c); from: buf[0] > right: 204 (0xcc); from: 0xCC > test-mbrtoc8.c:523: numeric comparison failure > left: 0 (0x0); from: mbrtoc8 (buf, mbs, 1, &s) > right: 18446744073709551613 (0xfffffffffffffffd); from: (size_t) -3 > test-mbrtoc8.c:524: numeric comparison failure > left: 0 (0x0); from: buf[0] > right: 140 (0x8c); from: 0x8C > error: 12 test failures These 2 tests fail on their first commit itself, unless this issue is specific to my machine. commit f4fe72a4f7b22588a7c902e39ddd3dcd244bbf9f (HEAD) Author: Tom Honermann <tom@honermann.net> Date: Thu Jun 30 08:52:15 2022 -0400 stdlib: Tests for mbrtoc8, c8rtomb, and the char8_t typedef. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) 2022-07-29 16:08 ` Sunil Pandey @ 2022-07-29 17:46 ` Sunil Pandey 2022-07-29 17:52 ` H.J. Lu 0 siblings, 1 reply; 10+ messages in thread From: Sunil Pandey @ 2022-07-29 17:46 UTC (permalink / raw) To: Carlos O'Donell, tom, Hongjiu Lu; +Cc: libc-alpha On Fri, Jul 29, 2022 at 9:08 AM Sunil Pandey <skpgkp2@gmail.com> wrote: > > On Fri, Jul 29, 2022 at 8:43 AM Sunil Pandey <skpgkp2@gmail.com> wrote: > > > > On Fri, Jul 29, 2022 at 8:26 AM Carlos O'Donell via Libc-alpha > > <libc-alpha@sourceware.org> wrote: > > > > > > Just posting here for the record that I see a glibc 2.36 build failure > > > with Fedora 36 and gcc 12. > > > > > > localealias.c: In function ‘read_alias_file’: > > > localealias.c:335:56: error: pointer may be used after ‘realloc’ [-Werror=use-after-free] > > > 335 | map[i].alias += new_pool - string_space; > > > | ~~~~~~~~~^~~~~~~~~~~~~~ > > > localealias.c:325:49: note: call to ‘realloc’ here > > > 325 | char *new_pool = (char *) realloc (string_space, new_size); > > > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > cc1: all warnings being treated as errors > > > > > > I'm going to review this quickly before we make the glibc release. > > > > > > -- > > > Cheers, > > > Carlos. > > > > > > > I am getting these 2 wide string test failures on my SKX server. > > > > FAIL: wcsmbs/test-c8rtomb (Not reproducible) > > > > FAIL: wcsmbs/test-mbrtoc8 > > > > $ wcsmbs/test-mbrtoc8 > > test-mbrtoc8.c:477: numeric comparison failure > > left: 2 (0x2); from: mbrtoc8 (buf, mbs, 1, &s) > > right: 1 (0x1); from: (size_t) 1 > > test-mbrtoc8.c:479: numeric comparison failure > > left: 0 (0x0); from: buf[0] > > right: 195 (0xc3); from: 0xC3 > > test-mbrtoc8.c:481: numeric comparison failure > > left: 204 (0xcc); from: buf[0] > > right: 138 (0x8a); from: 0x8A > > test-mbrtoc8.c:483: numeric comparison failure > > left: 132 (0x84); from: buf[0] > > right: 204 (0xcc); from: 0xCC > > test-mbrtoc8.c:484: numeric comparison failure > > left: 0 (0x0); from: mbrtoc8 (buf, mbs, 1, &s) > > right: 18446744073709551613 (0xfffffffffffffffd); from: (size_t) -3 > > test-mbrtoc8.c:485: numeric comparison failure > > left: 0 (0x0); from: buf[0] > > right: 132 (0x84); from: 0x84 > > test-mbrtoc8.c:516: numeric comparison failure > > left: 2 (0x2); from: mbrtoc8 (buf, mbs, 1, &s) > > right: 1 (0x1); from: (size_t) 1 > > test-mbrtoc8.c:518: numeric comparison failure > > left: 0 (0x0); from: buf[0] > > right: 195 (0xc3); from: 0xC3 > > test-mbrtoc8.c:520: numeric comparison failure > > left: 204 (0xcc); from: buf[0] > > right: 170 (0xaa); from: 0xAA > > test-mbrtoc8.c:522: numeric comparison failure > > left: 140 (0x8c); from: buf[0] > > right: 204 (0xcc); from: 0xCC > > test-mbrtoc8.c:523: numeric comparison failure > > left: 0 (0x0); from: mbrtoc8 (buf, mbs, 1, &s) > > right: 18446744073709551613 (0xfffffffffffffffd); from: (size_t) -3 > > test-mbrtoc8.c:524: numeric comparison failure > > left: 0 (0x0); from: buf[0] > > right: 140 (0x8c); from: 0x8C > > error: 12 test failures > > These 2 tests fail on their first commit itself, unless this issue > is specific to my machine. > > commit f4fe72a4f7b22588a7c902e39ddd3dcd244bbf9f (HEAD) > Author: Tom Honermann <tom@honermann.net> > Date: Thu Jun 30 08:52:15 2022 -0400 > > stdlib: Tests for mbrtoc8, c8rtomb, and the char8_t typedef. Steps to reproduce: make glibc make check subdirs=wcsmbs -j40 ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) 2022-07-29 17:46 ` Sunil Pandey @ 2022-07-29 17:52 ` H.J. Lu 2022-07-29 18:07 ` Sunil Pandey 0 siblings, 1 reply; 10+ messages in thread From: H.J. Lu @ 2022-07-29 17:52 UTC (permalink / raw) To: Sunil Pandey; +Cc: Carlos O'Donell, Tom Honermann, libc-alpha On Fri, Jul 29, 2022 at 10:47 AM Sunil Pandey <skpgkp2@gmail.com> wrote: > > On Fri, Jul 29, 2022 at 9:08 AM Sunil Pandey <skpgkp2@gmail.com> wrote: > > > > On Fri, Jul 29, 2022 at 8:43 AM Sunil Pandey <skpgkp2@gmail.com> wrote: > > > > > > On Fri, Jul 29, 2022 at 8:26 AM Carlos O'Donell via Libc-alpha > > > <libc-alpha@sourceware.org> wrote: > > > > > > > > Just posting here for the record that I see a glibc 2.36 build failure > > > > with Fedora 36 and gcc 12. > > > > > > > > localealias.c: In function ‘read_alias_file’: > > > > localealias.c:335:56: error: pointer may be used after ‘realloc’ [-Werror=use-after-free] > > > > 335 | map[i].alias += new_pool - string_space; > > > > | ~~~~~~~~~^~~~~~~~~~~~~~ > > > > localealias.c:325:49: note: call to ‘realloc’ here > > > > 325 | char *new_pool = (char *) realloc (string_space, new_size); > > > > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > > cc1: all warnings being treated as errors > > > > > > > > I'm going to review this quickly before we make the glibc release. > > > > > > > > -- > > > > Cheers, > > > > Carlos. > > > > > > > > > > I am getting these 2 wide string test failures on my SKX server. > > > > > > FAIL: wcsmbs/test-c8rtomb (Not reproducible) > > > > > > FAIL: wcsmbs/test-mbrtoc8 > > > > > > $ wcsmbs/test-mbrtoc8 > > > test-mbrtoc8.c:477: numeric comparison failure > > > left: 2 (0x2); from: mbrtoc8 (buf, mbs, 1, &s) > > > right: 1 (0x1); from: (size_t) 1 > > > test-mbrtoc8.c:479: numeric comparison failure > > > left: 0 (0x0); from: buf[0] > > > right: 195 (0xc3); from: 0xC3 > > > test-mbrtoc8.c:481: numeric comparison failure > > > left: 204 (0xcc); from: buf[0] > > > right: 138 (0x8a); from: 0x8A > > > test-mbrtoc8.c:483: numeric comparison failure > > > left: 132 (0x84); from: buf[0] > > > right: 204 (0xcc); from: 0xCC > > > test-mbrtoc8.c:484: numeric comparison failure > > > left: 0 (0x0); from: mbrtoc8 (buf, mbs, 1, &s) > > > right: 18446744073709551613 (0xfffffffffffffffd); from: (size_t) -3 > > > test-mbrtoc8.c:485: numeric comparison failure > > > left: 0 (0x0); from: buf[0] > > > right: 132 (0x84); from: 0x84 > > > test-mbrtoc8.c:516: numeric comparison failure > > > left: 2 (0x2); from: mbrtoc8 (buf, mbs, 1, &s) > > > right: 1 (0x1); from: (size_t) 1 > > > test-mbrtoc8.c:518: numeric comparison failure > > > left: 0 (0x0); from: buf[0] > > > right: 195 (0xc3); from: 0xC3 > > > test-mbrtoc8.c:520: numeric comparison failure > > > left: 204 (0xcc); from: buf[0] > > > right: 170 (0xaa); from: 0xAA > > > test-mbrtoc8.c:522: numeric comparison failure > > > left: 140 (0x8c); from: buf[0] > > > right: 204 (0xcc); from: 0xCC > > > test-mbrtoc8.c:523: numeric comparison failure > > > left: 0 (0x0); from: mbrtoc8 (buf, mbs, 1, &s) > > > right: 18446744073709551613 (0xfffffffffffffffd); from: (size_t) -3 > > > test-mbrtoc8.c:524: numeric comparison failure > > > left: 0 (0x0); from: buf[0] > > > right: 140 (0x8c); from: 0x8C > > > error: 12 test failures > > > > These 2 tests fail on their first commit itself, unless this issue > > is specific to my machine. > > > > commit f4fe72a4f7b22588a7c902e39ddd3dcd244bbf9f (HEAD) > > Author: Tom Honermann <tom@honermann.net> > > Date: Thu Jun 30 08:52:15 2022 -0400 > > > > stdlib: Tests for mbrtoc8, c8rtomb, and the char8_t typedef. > > Steps to reproduce: > > make glibc > make check subdirs=wcsmbs -j40 This patch should fix it: https://sourceware.org/pipermail/libc-alpha/2022-July/141144.html -- H.J. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) 2022-07-29 17:52 ` H.J. Lu @ 2022-07-29 18:07 ` Sunil Pandey 0 siblings, 0 replies; 10+ messages in thread From: Sunil Pandey @ 2022-07-29 18:07 UTC (permalink / raw) To: H.J. Lu; +Cc: Carlos O'Donell, Tom Honermann, libc-alpha On Fri, Jul 29, 2022 at 10:52 AM H.J. Lu <hjl.tools@gmail.com> wrote: > > On Fri, Jul 29, 2022 at 10:47 AM Sunil Pandey <skpgkp2@gmail.com> wrote: > > > > On Fri, Jul 29, 2022 at 9:08 AM Sunil Pandey <skpgkp2@gmail.com> wrote: > > > > > > On Fri, Jul 29, 2022 at 8:43 AM Sunil Pandey <skpgkp2@gmail.com> wrote: > > > > > > > > On Fri, Jul 29, 2022 at 8:26 AM Carlos O'Donell via Libc-alpha > > > > <libc-alpha@sourceware.org> wrote: > > > > > > > > > > Just posting here for the record that I see a glibc 2.36 build failure > > > > > with Fedora 36 and gcc 12. > > > > > > > > > > localealias.c: In function ‘read_alias_file’: > > > > > localealias.c:335:56: error: pointer may be used after ‘realloc’ [-Werror=use-after-free] > > > > > 335 | map[i].alias += new_pool - string_space; > > > > > | ~~~~~~~~~^~~~~~~~~~~~~~ > > > > > localealias.c:325:49: note: call to ‘realloc’ here > > > > > 325 | char *new_pool = (char *) realloc (string_space, new_size); > > > > > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > > > cc1: all warnings being treated as errors > > > > > > > > > > I'm going to review this quickly before we make the glibc release. > > > > > > > > > > -- > > > > > Cheers, > > > > > Carlos. > > > > > > > > > > > > > I am getting these 2 wide string test failures on my SKX server. > > > > > > > > FAIL: wcsmbs/test-c8rtomb (Not reproducible) > > > > > > > > FAIL: wcsmbs/test-mbrtoc8 > > > > > > > > $ wcsmbs/test-mbrtoc8 > > > > test-mbrtoc8.c:477: numeric comparison failure > > > > left: 2 (0x2); from: mbrtoc8 (buf, mbs, 1, &s) > > > > right: 1 (0x1); from: (size_t) 1 > > > > test-mbrtoc8.c:479: numeric comparison failure > > > > left: 0 (0x0); from: buf[0] > > > > right: 195 (0xc3); from: 0xC3 > > > > test-mbrtoc8.c:481: numeric comparison failure > > > > left: 204 (0xcc); from: buf[0] > > > > right: 138 (0x8a); from: 0x8A > > > > test-mbrtoc8.c:483: numeric comparison failure > > > > left: 132 (0x84); from: buf[0] > > > > right: 204 (0xcc); from: 0xCC > > > > test-mbrtoc8.c:484: numeric comparison failure > > > > left: 0 (0x0); from: mbrtoc8 (buf, mbs, 1, &s) > > > > right: 18446744073709551613 (0xfffffffffffffffd); from: (size_t) -3 > > > > test-mbrtoc8.c:485: numeric comparison failure > > > > left: 0 (0x0); from: buf[0] > > > > right: 132 (0x84); from: 0x84 > > > > test-mbrtoc8.c:516: numeric comparison failure > > > > left: 2 (0x2); from: mbrtoc8 (buf, mbs, 1, &s) > > > > right: 1 (0x1); from: (size_t) 1 > > > > test-mbrtoc8.c:518: numeric comparison failure > > > > left: 0 (0x0); from: buf[0] > > > > right: 195 (0xc3); from: 0xC3 > > > > test-mbrtoc8.c:520: numeric comparison failure > > > > left: 204 (0xcc); from: buf[0] > > > > right: 170 (0xaa); from: 0xAA > > > > test-mbrtoc8.c:522: numeric comparison failure > > > > left: 140 (0x8c); from: buf[0] > > > > right: 204 (0xcc); from: 0xCC > > > > test-mbrtoc8.c:523: numeric comparison failure > > > > left: 0 (0x0); from: mbrtoc8 (buf, mbs, 1, &s) > > > > right: 18446744073709551613 (0xfffffffffffffffd); from: (size_t) -3 > > > > test-mbrtoc8.c:524: numeric comparison failure > > > > left: 0 (0x0); from: buf[0] > > > > right: 140 (0x8c); from: 0x8C > > > > error: 12 test failures > > > > > > These 2 tests fail on their first commit itself, unless this issue > > > is specific to my machine. > > > > > > commit f4fe72a4f7b22588a7c902e39ddd3dcd244bbf9f (HEAD) > > > Author: Tom Honermann <tom@honermann.net> > > > Date: Thu Jun 30 08:52:15 2022 -0400 > > > > > > stdlib: Tests for mbrtoc8, c8rtomb, and the char8_t typedef. > > > > Steps to reproduce: > > > > make glibc > > make check subdirs=wcsmbs -j40 > > This patch should fix it: > > https://sourceware.org/pipermail/libc-alpha/2022-July/141144.html > > -- > H.J. It fixes the issue. --Sunil ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) 2022-07-29 15:26 glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) Carlos O'Donell 2022-07-29 15:43 ` Sunil Pandey @ 2022-07-29 15:52 ` Mark Wielaard 2022-07-29 16:34 ` Carlos O'Donell 2022-07-29 16:39 ` Paul Eggert 3 siblings, 0 replies; 10+ messages in thread From: Mark Wielaard @ 2022-07-29 15:52 UTC (permalink / raw) To: Carlos O'Donell, libc-alpha Hi Carlos, On Fri, 2022-07-29 at 11:26 -0400, Carlos O'Donell via Libc-alpha wrote: > Just posting here for the record that I see a glibc 2.36 build > failure > with Fedora 36 and gcc 12. > > localealias.c: In function ‘read_alias_file’: > localealias.c:335:56: error: pointer may be used after ‘realloc’ [- > Werror=use-after-free] > 335 | map[i].alias += new_pool - > string_space; > | ~~~~~~~~~^~~~~~ > ~~~~~~~~ > localealias.c:325:49: note: call to ‘realloc’ here > 325 | char *new_pool = (char *) realloc > (string_space, new_size); > | ^~~~~~~~~~~~~ > ~~~~~~~~~~~~~~~~~~~ > cc1: all warnings being treated as errors > > I'm going to review this quickly before we make the glibc release. We aren't seeing those on the Fedora 36 buildbot or on other gcc 12 using distros: https://builder.sourceware.org/buildbot/#/builders?tags=glibc There was a bug in earlier gcc12 releases with realloc that was fixed by https://gcc.gnu.org/r12-6712-g2f714642e574c64e1c0e093cad3de6f8accb6ec7 Maybe updating gcc might help? Cheers, Mark ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) 2022-07-29 15:26 glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) Carlos O'Donell 2022-07-29 15:43 ` Sunil Pandey 2022-07-29 15:52 ` Mark Wielaard @ 2022-07-29 16:34 ` Carlos O'Donell 2022-07-29 16:39 ` Paul Eggert 3 siblings, 0 replies; 10+ messages in thread From: Carlos O'Donell @ 2022-07-29 16:34 UTC (permalink / raw) To: libc-alpha On 7/29/22 11:26, Carlos O'Donell wrote: > Just posting here for the record that I see a glibc 2.36 build failure > with Fedora 36 and gcc 12. > > localealias.c: In function ‘read_alias_file’: > localealias.c:335:56: error: pointer may be used after ‘realloc’ [-Werror=use-after-free] > 335 | map[i].alias += new_pool - string_space; > | ~~~~~~~~~^~~~~~~~~~~~~~ > localealias.c:325:49: note: call to ‘realloc’ here > 325 | char *new_pool = (char *) realloc (string_space, new_size); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > cc1: all warnings being treated as errors > > I'm going to review this quickly before we make the glibc release. This was an issue with my automation. The build is clean with gcc 12.1. -- Cheers, Carlos. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) 2022-07-29 15:26 glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) Carlos O'Donell ` (2 preceding siblings ...) 2022-07-29 16:34 ` Carlos O'Donell @ 2022-07-29 16:39 ` Paul Eggert 2022-07-29 16:50 ` Andreas Schwab 3 siblings, 1 reply; 10+ messages in thread From: Paul Eggert @ 2022-07-29 16:39 UTC (permalink / raw) To: Carlos O'Donell; +Cc: libc-alpha [-- Attachment #1: Type: text/plain, Size: 1263 bytes --] On 7/29/22 08:26, Carlos O'Donell via Libc-alpha wrote: > Just posting here for the record that I see a glibc 2.36 build failure > with Fedora 36 and gcc 12. > > localealias.c: In function ‘read_alias_file’: > localealias.c:335:56: error: pointer may be used after ‘realloc’ [-Werror=use-after-free] > 335 | map[i].alias += new_pool - string_space; > | ~~~~~~~~~^~~~~~~~~~~~~~ > localealias.c:325:49: note: call to ‘realloc’ here > 325 | char *new_pool = (char *) realloc (string_space, new_size); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > cc1: all warnings being treated as errors > > I'm going to review this quickly before we make the glibc release. > One option is to fix the conformance bug rather than continue to try to paper it over with a pragma. In looking into it, I found two kinds of conformance bugs in localealias.c: first, accessing a realloced pointer (which GCC warns about), and second, calling a function via an incompatible function pointer (which GCC doesn't warn about). Proposed patch attached. I have compiled but not tested this. [-- Attachment #2: 0001-Avoid-undefined-behavior-in-localealias.c.patch --] [-- Type: text/x-patch, Size: 5831 bytes --] From c6a660aaae9efab49ed670971aa1dad7ed011e22 Mon Sep 17 00:00:00 2001 From: Paul Eggert <eggert@cs.ucla.edu> Date: Fri, 29 Jul 2022 09:33:55 -0700 Subject: [PATCH] Avoid undefined behavior in localealias.c MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Do not access a pointer after realloc, and do not assume that function pointers can be cast willy-nilly. Problem reported by Carlos O’Donell in: https://sourceware.org/pipermail/libc-alpha/2022-July/141127.html * intl/localealias.c (struct alias_map): Members are now offsets from string_space, not pointers, so that they survive realloc. All uses changed. (_nl_expand_alias): Pass name as-is to bsearch, and use bsearch_alias_compare which knows about this. (_nl_expand_alias, read_alias_file): Do not cast function pointers in a way that violates the C standard. (read_alias_file): Remove no-longer-needed pragma and code to adjust pointers after realloc. Pass qsort_alias_compare to qsort. (alias_compare): Change signature so that it merely compares strings. (qsort_alias_compare, bsearch_alias_compare): New functions. --- intl/localealias.c | 80 +++++++++++++++++++--------------------------- 1 file changed, 33 insertions(+), 47 deletions(-) diff --git a/intl/localealias.c b/intl/localealias.c index b36092363a..56b4ea58a4 100644 --- a/intl/localealias.c +++ b/intl/localealias.c @@ -121,8 +121,9 @@ __libc_lock_define_initialized (static, lock) struct alias_map { - const char *alias; - const char *value; + /* These are offsets from string_space, so that they survive realloc. */ + size_t alias; + size_t value; }; @@ -141,8 +142,8 @@ static size_t maxmap; /* Prototypes for local functions. */ static size_t read_alias_file (const char *fname, int fname_len); static int extend_alias_table (void); -static int alias_compare (const struct alias_map *map1, - const struct alias_map *map2); +static int qsort_alias_compare (void const *map1, void const *map2); +static int bsearch_alias_compare (void const *key, void const *elt); const char * @@ -160,23 +161,17 @@ _nl_expand_alias (const char *name) do { - struct alias_map item; - - item.alias = name; - if (nmap > 0) - retval = (struct alias_map *) bsearch (&item, map, nmap, + retval = (struct alias_map *) bsearch (name, map, nmap, sizeof (struct alias_map), - (int (*) (const void *, - const void *) - ) alias_compare); + bsearch_alias_compare); else retval = NULL; /* We really found an alias. Return the value. */ if (retval != NULL) { - result = retval->value; + result = string_space + retval->value; break; } @@ -318,14 +313,6 @@ read_alias_file (const char *fname, int fname_len) if (string_space_act + alias_len + value_len > string_space_max) { -#pragma GCC diagnostic push - -#if defined __GNUC__ && __GNUC__ >= 12 - /* Suppress the valid GCC 12 warning until the code below is changed - to avoid using pointers to the reallocated block. */ -# pragma GCC diagnostic ignored "-Wuse-after-free" -#endif - /* Increase size of memory pool. */ size_t new_size = (string_space_max + (alias_len + value_len > 1024 @@ -334,33 +321,18 @@ read_alias_file (const char *fname, int fname_len) if (new_pool == NULL) goto out; - if (__builtin_expect (string_space != new_pool, 0)) - { - size_t i; - - for (i = 0; i < nmap; i++) - { - map[i].alias += new_pool - string_space; - map[i].value += new_pool - string_space; - } - } - string_space = new_pool; string_space_max = new_size; } - map[nmap].alias = - (const char *) memcpy (&string_space[string_space_act], - alias, alias_len); + memcpy (&string_space[string_space_act], alias, alias_len); + map[nmap].alias = string_space_act; string_space_act += alias_len; - map[nmap].value = - (const char *) memcpy (&string_space[string_space_act], - value, value_len); + memcpy (&string_space[string_space_act], value, value_len); + map[nmap].value = string_space_act; string_space_act += value_len; -#pragma GCC diagnostic pop - ++nmap; ++added; } @@ -384,8 +356,7 @@ read_alias_file (const char *fname, int fname_len) fclose (fp); if (added > 0) - qsort (map, nmap, sizeof (struct alias_map), - (int (*) (const void *, const void *)) alias_compare); + qsort (map, nmap, sizeof (struct alias_map), qsort_alias_compare); return added; } @@ -409,15 +380,14 @@ extend_alias_table (void) return 0; } - static int -alias_compare (const struct alias_map *map1, const struct alias_map *map2) +alias_compare (char const *alias1, char const *alias2) { #if defined _LIBC || defined HAVE_STRCASECMP - return strcasecmp (map1->alias, map2->alias); + return strcasecmp (alias1, alias2); #else - const unsigned char *p1 = (const unsigned char *) map1->alias; - const unsigned char *p2 = (const unsigned char *) map2->alias; + const unsigned char *p1 = (const unsigned char *) alias1; + const unsigned char *p2 = (const unsigned char *) alias2; unsigned char c1, c2; if (p1 == p2) @@ -439,3 +409,19 @@ alias_compare (const struct alias_map *map1, const struct alias_map *map2) return c1 - c2; #endif } + +static int +qsort_alias_compare (void const *vmap1, void const *vmap2) +{ + struct alias_map const *map1 = vmap1; + struct alias_map const *map2 = vmap2; + return alias_compare (string_space + map1->alias, + string_space + map2->alias); +} + +static int +bsearch_alias_compare (void const *vkey, void const *velt) +{ + struct alias_map const *elt = velt; + return alias_compare (vkey, string_space + elt->alias); +} -- 2.37.1 ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) 2022-07-29 16:39 ` Paul Eggert @ 2022-07-29 16:50 ` Andreas Schwab 0 siblings, 0 replies; 10+ messages in thread From: Andreas Schwab @ 2022-07-29 16:50 UTC (permalink / raw) To: Paul Eggert; +Cc: Carlos O'Donell, libc-alpha On Jul 29 2022, Paul Eggert wrote: > +static int qsort_alias_compare (void const *map1, void const *map2); > +static int bsearch_alias_compare (void const *key, void const *elt); Wrong placement of const. -- Andreas Schwab, schwab@linux-m68k.org GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1 "And now for something completely different." ^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2022-07-29 18:07 UTC | newest] Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2022-07-29 15:26 glibc 2.36 build failure on Fedora 36 with gcc 12 (-Werror=use-after-free) Carlos O'Donell 2022-07-29 15:43 ` Sunil Pandey 2022-07-29 16:08 ` Sunil Pandey 2022-07-29 17:46 ` Sunil Pandey 2022-07-29 17:52 ` H.J. Lu 2022-07-29 18:07 ` Sunil Pandey 2022-07-29 15:52 ` Mark Wielaard 2022-07-29 16:34 ` Carlos O'Donell 2022-07-29 16:39 ` Paul Eggert 2022-07-29 16:50 ` Andreas Schwab
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).