Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix integer overflow undefined behaviour #177

Closed
wants to merge 1 commit into from
Closed

Fix integer overflow undefined behaviour #177

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Fix integer overflow undefined behaviour 
Even though delta's type is PCRE2_SIZE, the computation for delta uses
all integers at the right hand side.
This means that there is a potential integer overflow. The if below then
checks whether a computation equivalent to delta is larger than INT_MAX:
the overflow check.
However, since integer overflow is undefined behaviour, the compiler may
assume it never happens. Therefore, the overflow check can be assumed to
always be false even though there is casting because according to the
compiler if an overflow doesn't happen for ints, it surely does not
happen for INT64_OR_DOUBLE...

I found this issue using the stack static analysis tool.
I verified that the compiler actually optimizes away the check by
looking at the IR.

Fix it by computing delta with the casts first, and use that same delta
in the if.
  • Loading branch information
@nielsdos
nielsdos committed Dec 25, 2022
commit abf583769186382e4b9d20f9c9caecc7f36da46a
6 changes: 2 additions & 4 deletions src/pcre2_compile.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7117,10 7117,8 @@ for (;; pptr )

if (lengthptr != NULL)
{
PCRE2_SIZE delta = replicate*(1 LINK_SIZE);
if ((INT64_OR_DOUBLE)replicate*
(INT64_OR_DOUBLE)(1 LINK_SIZE) >
(INT64_OR_DOUBLE)INT_MAX ||
INT64_OR_DOUBLE delta = (INT64_OR_DOUBLE)replicate*(INT64_OR_DOUBLE)(1 LINK_SIZE);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if a broken int64 cast is being used here, this is likely to make the problem worst by potentially halving the width of delta.

it migth be better IMHO to only cast "replicate" to ensure the multiplication is not being done with plain ints

Copy link
Contributor

@carenas carenas Dec 28, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a maybe cleaner way to approach this sort of check pushed (not tested) in the following branch.

note that similar logic is used in several other places, so not sure why the static analyzer used didn't pick on those.

also, details on the system/compiler that was affected (so a fix could be tested) would be ideal.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Your approach is indeed cleaner.
System details: Linux 6.1.3, Clang 14.0.6

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could you confirm the check is indeed getting removed?, still can't reproduce that with the same compiler as shown by the following simplified code:

$ cat i.c
#include <stdio.h>
#include <limits.h>
#include <stdlib.h>

int main(int argc, char *argv[])
{
	int a = atoi(argv[1]);
	
	size_t m;
	       
	m = a * 2;
	if ((long)a * 2 > INT_MAX)
		printf("OVERFLOW\n");
	printf("%zu\n", m);
	return 0;
}
$ clang --version
Debian clang version 14.0.6
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
$ clang -O3 -o i i.c
$ ./i 2147483647
OVERFLOW
18446744073709551614

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That example gives the same result on my system, so this PR was probably a mistake.

if (delta > (INT64_OR_DOUBLE)INT_MAX ||
OFLOW_MAX - *lengthptr < delta)
{
*errorcodeptr = ERR20;
Expand Down