1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
From 3328e98bcbf2930cd7eea3e6c92ad5dcbdf4794f Mon Sep 17 00:00:00 2001
From: Yuanjie Huang <yuanjie.huang@windriver.com>
Date: Wed, 24 Aug 2016 03:15:43 +0000
Subject: [PATCH] Fix potential signed overflow in pointer arithmatic
Pointer arithmatic results in implementation defined signed integer
type, so that 's - src' in strlcpy and others may trigger signed overflow.
In case of compilation by gcc or clang with -ftrapv option, the overflow
would lead to program abort.
Upstream-Status: Submitted [http://bugzilla.mindrot.org/show_bug.cgi?id=2608]
Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
---
openbsd-compat/strlcat.c | 8 ++++++--
openbsd-compat/strlcpy.c | 8 ++++++--
openbsd-compat/strnlen.c | 8 ++++++--
3 files changed, 18 insertions(+), 6 deletions(-)
diff --git a/openbsd-compat/strlcat.c b/openbsd-compat/strlcat.c
index bcc1b61..e758ebf 100644
--- a/openbsd-compat/strlcat.c
+++ b/openbsd-compat/strlcat.c
@@ -23,6 +23,7 @@
#include <sys/types.h>
#include <string.h>
+#include <stdint.h>
/*
* Appends src to string dst of size siz (unlike strncat, siz is the
@@ -55,8 +56,11 @@ strlcat(char *dst, const char *src, size_t siz)
s++;
}
*d = '\0';
-
- return(dlen + (s - src)); /* count does not include NUL */
+ /*
+ * Cast pointers to unsigned type before calculation, to avoid signed
+ * overflow when the string ends where the MSB has changed.
+ */
+ return (dlen + ((uintptr_t)s - (uintptr_t)src)); /* count does not include NUL */
}
#endif /* !HAVE_STRLCAT */
diff --git a/openbsd-compat/strlcpy.c b/openbsd-compat/strlcpy.c
index b4b1b60..b06f374 100644
--- a/openbsd-compat/strlcpy.c
+++ b/openbsd-compat/strlcpy.c
@@ -23,6 +23,7 @@
#include <sys/types.h>
#include <string.h>
+#include <stdint.h>
/*
* Copy src to string dst of size siz. At most siz-1 characters
@@ -51,8 +52,11 @@ strlcpy(char *dst, const char *src, size_t siz)
while (*s++)
;
}
-
- return(s - src - 1); /* count does not include NUL */
+ /*
+ * Cast pointers to unsigned type before calculation, to avoid signed
+ * overflow when the string ends where the MSB has changed.
+ */
+ return ((uintptr_t)s - (uintptr_t)src - 1); /* count does not include NUL */
}
#endif /* !HAVE_STRLCPY */
diff --git a/openbsd-compat/strnlen.c b/openbsd-compat/strnlen.c
index 93d5155..9b8de5d 100644
--- a/openbsd-compat/strnlen.c
+++ b/openbsd-compat/strnlen.c
@@ -23,6 +23,7 @@
#include <sys/types.h>
#include <string.h>
+#include <stdint.h>
size_t
strnlen(const char *str, size_t maxlen)
@@ -31,7 +32,10 @@ strnlen(const char *str, size_t maxlen)
for (cp = str; maxlen != 0 && *cp != '\0'; cp++, maxlen--)
;
-
- return (size_t)(cp - str);
+ /*
+ * Cast pointers to unsigned type before calculation, to avoid signed
+ * overflow when the string ends where the MSB has changed.
+ */
+ return (size_t)((uintptr_t)cp - (uintptr_t)str);
}
#endif
--
1.9.1
|
