From 3328e98bcbf2930cd7eea3e6c92ad5dcbdf4794f Mon Sep 17 00:00:00 2001 From: Yuanjie Huang Date: Wed, 24 Aug 2016 03:15:43 +0000 Subject: [PATCH] Fix potential signed overflow in pointer arithmatic Pointer arithmatic results in implementation defined signed integer type, so that 's - src' in strlcpy and others may trigger signed overflow. In case of compilation by gcc or clang with -ftrapv option, the overflow would lead to program abort. Upstream-Status: Submitted [http://bugzilla.mindrot.org/show_bug.cgi?id=2608] Signed-off-by: Yuanjie Huang --- openbsd-compat/strlcat.c | 8 ++++++-- openbsd-compat/strlcpy.c | 8 ++++++-- openbsd-compat/strnlen.c | 8 ++++++-- 3 files changed, 18 insertions(+), 6 deletions(-) diff --git a/openbsd-compat/strlcat.c b/openbsd-compat/strlcat.c index bcc1b61..e758ebf 100644 --- a/openbsd-compat/strlcat.c +++ b/openbsd-compat/strlcat.c @@ -23,6 +23,7 @@ #include #include +#include /* * Appends src to string dst of size siz (unlike strncat, siz is the @@ -55,8 +56,11 @@ strlcat(char *dst, const char *src, size_t siz) s++; } *d = '\0'; - - return(dlen + (s - src)); /* count does not include NUL */ + /* + * Cast pointers to unsigned type before calculation, to avoid signed + * overflow when the string ends where the MSB has changed. + */ + return (dlen + ((uintptr_t)s - (uintptr_t)src)); /* count does not include NUL */ } #endif /* !HAVE_STRLCAT */ diff --git a/openbsd-compat/strlcpy.c b/openbsd-compat/strlcpy.c index b4b1b60..b06f374 100644 --- a/openbsd-compat/strlcpy.c +++ b/openbsd-compat/strlcpy.c @@ -23,6 +23,7 @@ #include #include +#include /* * Copy src to string dst of size siz. At most siz-1 characters @@ -51,8 +52,11 @@ strlcpy(char *dst, const char *src, size_t siz) while (*s++) ; } - - return(s - src - 1); /* count does not include NUL */ + /* + * Cast pointers to unsigned type before calculation, to avoid signed + * overflow when the string ends where the MSB has changed. + */ + return ((uintptr_t)s - (uintptr_t)src - 1); /* count does not include NUL */ } #endif /* !HAVE_STRLCPY */ diff --git a/openbsd-compat/strnlen.c b/openbsd-compat/strnlen.c index 93d5155..9b8de5d 100644 --- a/openbsd-compat/strnlen.c +++ b/openbsd-compat/strnlen.c @@ -23,6 +23,7 @@ #include #include +#include size_t strnlen(const char *str, size_t maxlen) @@ -31,7 +32,10 @@ strnlen(const char *str, size_t maxlen) for (cp = str; maxlen != 0 && *cp != '\0'; cp++, maxlen--) ; - - return (size_t)(cp - str); + /* + * Cast pointers to unsigned type before calculation, to avoid signed + * overflow when the string ends where the MSB has changed. + */ + return (size_t)((uintptr_t)cp - (uintptr_t)str); } #endif -- 1.9.1