+2020-12-29 Paul Eggert <eggert@cs.ucla.edu>
+
+ canonicalize: fix ptrdiff_t overflow bug
+ Problem reported by Adhemerval Zanella in:
+ https://sourceware.org/pipermail/libc-alpha/2020-December/121182.html
+ * lib/canonicalize-lgpl.c, lib/canonicalize.c:
+ Include intprops.h.
+ (NARROW_ADDRESSES): New constant.
+ * lib/canonicalize-lgpl.c (realpath_stk):m
+ * lib/canonicalize.c (canonicalize_filename_mode_stk):
+ Work even if strlen (END) does not fit in idx_t, or if adding
+ N to it overflows.
+ * modules/canonicalize, modules/canonicalize-lgpl (Depends-on):
+ Add intprops.
+
2020-12-28 Bruno Haible <bruno@clisp.org>
havelib: Fix for Solaris 11 OpenIndiana and Solaris 11 OmniOS.
#include <eloop-threshold.h>
#include <filename.h>
#include <idx.h>
+#include <intprops.h>
#include <scratch_buffer.h>
#ifdef _LIBC
# define IF_LINT(Code) /* empty */
#endif
+/* True if adding two valid object sizes might overflow idx_t.
+ As a practical matter, this cannot happen on 64-bit machines. */
+enum { NARROW_ADDRESSES = IDX_MAX >> 31 >> 31 == 0 };
+
#ifndef DOUBLE_SLASH_IS_DISTINCT_ROOT
# define DOUBLE_SLASH_IS_DISTINCT_ROOT false
#endif
idx_t end_idx IF_LINT (= 0);
if (end_in_extra_buffer)
end_idx = end - extra_buf;
- idx_t len = strlen (end);
+ size_t len = strlen (end);
+ if (NARROW_ADDRESSES && INT_ADD_OVERFLOW (len, n))
+ {
+ __set_errno (ENOMEM);
+ goto error;
+ }
while (extra_buffer.length <= len + n)
{
if (!scratch_buffer_grow_preserve (&extra_buffer))
#include <filename.h>
#include <idx.h>
+#include <intprops.h>
#include <scratch_buffer.h>
#include "attribute.h"
# define IF_LINT(Code) /* empty */
#endif
+/* True if adding two valid object sizes might overflow idx_t.
+ As a practical matter, this cannot happen on 64-bit machines. */
+enum { NARROW_ADDRESSES = IDX_MAX >> 31 >> 31 == 0 };
+
#ifndef DOUBLE_SLASH_IS_DISTINCT_ROOT
# define DOUBLE_SLASH_IS_DISTINCT_ROOT false
#endif
idx_t end_idx IF_LINT (= 0);
if (end_in_extra_buffer)
end_idx = end - extra_buf;
- idx_t len = strlen (end);
+ size_t len = strlen (end);
+ if (NARROW_ADDRESSES && INT_ADD_OVERFLOW (len, n))
+ {
+ errno = ENOMEM;
+ goto error;
+ }
while (extra_buffer.length <= len + n)
{
if (!scratch_buffer_grow_preserve (&extra_buffer))
getcwd
hash-triple-simple
idx
+intprops
memmove
mempcpy
nocrash
filename [test $HAVE_CANONICALIZE_FILE_NAME = 0 || test $REPLACE_CANONICALIZE_FILE_NAME = 1]
free-posix [test $HAVE_CANONICALIZE_FILE_NAME = 0 || test $REPLACE_CANONICALIZE_FILE_NAME = 1]
idx [test $HAVE_CANONICALIZE_FILE_NAME = 0 || test $REPLACE_CANONICALIZE_FILE_NAME = 1]
+intprops [test $HAVE_CANONICALIZE_FILE_NAME = 0 || test $REPLACE_CANONICALIZE_FILE_NAME = 1]
libc-config [test $HAVE_CANONICALIZE_FILE_NAME = 0 || test $REPLACE_CANONICALIZE_FILE_NAME = 1]
malloc-posix [test $HAVE_CANONICALIZE_FILE_NAME = 0 || test $REPLACE_CANONICALIZE_FILE_NAME = 1]
memmove [test $HAVE_CANONICALIZE_FILE_NAME = 0 || test $REPLACE_CANONICALIZE_FILE_NAME = 1]