From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Andy Wingo Newsgroups: gmane.lisp.guile.bugs Subject: bug#13827: faulty range check in bytevector accessor Date: Mon, 20 Jun 2016 17:16:05 +0200 Message-ID: <87fus7howa.fsf@pobox.com> References: <87liaay0o1.fsf@Kagami.home> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1466436076 8671 80.91.229.3 (20 Jun 2016 15:21:16 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Mon, 20 Jun 2016 15:21:16 +0000 (UTC) Cc: 13827-done@debbugs.gnu.org To: "Ben Rocer" Original-X-From: bug-guile-bounces+guile-bugs=m.gmane.org@gnu.org Mon Jun 20 17:21:06 2016 Return-path: Envelope-to: guile-bugs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1bF10D-0004qR-4P for guile-bugs@m.gmane.org; Mon, 20 Jun 2016 17:20:41 +0200 Original-Received: from localhost ([::1]:44304 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bF10B-0006aW-Pe for guile-bugs@m.gmane.org; Mon, 20 Jun 2016 11:20:39 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:41393) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bF0wm-0002Gt-0R for bug-guile@gnu.org; Mon, 20 Jun 2016 11:17:10 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bF0wg-0005qb-QE for bug-guile@gnu.org; Mon, 20 Jun 2016 11:17:08 -0400 Original-Received: from debbugs.gnu.org ([208.118.235.43]:35524) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bF0wg-0005qW-H5 for bug-guile@gnu.org; Mon, 20 Jun 2016 11:17:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1bF0wg-0000Om-7d for bug-guile@gnu.org; Mon, 20 Jun 2016 11:17:02 -0400 Resent-From: Andy Wingo Original-Sender: "Debbugs-submit" Resent-To: bug-guile@gnu.org Resent-Date: Mon, 20 Jun 2016 15:17:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: cc-closed 13827 X-GNU-PR-Package: guile X-GNU-PR-Keywords: patch Mail-Followup-To: 13827@debbugs.gnu.org, wingo@pobox.com, ianprice90@googlemail.com Original-Received: via spool by 13827-done@debbugs.gnu.org id=D13827.14664357761468 (code D ref 13827); Mon, 20 Jun 2016 15:17:02 +0000 Original-Received: (at 13827-done) by debbugs.gnu.org; 20 Jun 2016 15:16:16 +0000 Original-Received: from localhost ([127.0.0.1]:47861 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bF0vw-0000Na-3m for submit@debbugs.gnu.org; Mon, 20 Jun 2016 11:16:16 -0400 Original-Received: from pb-sasl2.pobox.com ([64.147.108.67]:53546 helo=sasl.smtp.pobox.com) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bF0vu-0000NQ-33 for 13827-done@debbugs.gnu.org; Mon, 20 Jun 2016 11:16:14 -0400 Original-Received: from sasl.smtp.pobox.com (unknown [127.0.0.1]) by pb-sasl2.pobox.com (Postfix) with ESMTP id 7B438233B8; Mon, 20 Jun 2016 11:16:13 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=pobox.com; h=from:to:cc :subject:references:date:in-reply-to:message-id:mime-version :content-type; s=sasl; bh=TG2alww4aX5c5Cb1f/Bc2lTYFQY=; b=gNAlTx 322+tNTMNmyuMhWFa8wXsBxen5DFZOCkErprX5WoE0uJ6cN7URlIxG3+cyg+Ibdc QjW8KIXLHiQw0rnBLNxgG3iAa11fJBqfrj1s024Ck3sc9g8pCk1oNYI1jTCGcsfF 8V5SxnGYIE3/Ct4Hgq9/ABefV14jLvzVNA9XU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=pobox.com; h=from:to:cc :subject:references:date:in-reply-to:message-id:mime-version :content-type; q=dns; s=sasl; b=KmKkGbwbheXm8gb6pZ6xI7Ze2gfrLSbf RbuM8X5cMf4eqiCNfGsd5p6mOpU4qHaywhS4xNIxoYC27OqNdUIh6LqK2Dznr3Re w2CaoJXij8Iin2iguD+Ho3VwDA4U8PqSVvHu3Wjof3ZzXLN/91sYi5x5r2lG0JLU 2E2OEShTG10= Original-Received: from pb-sasl2.nyi.icgroup.com (unknown [127.0.0.1]) by pb-sasl2.pobox.com (Postfix) with ESMTP id 740CC233B7; Mon, 20 Jun 2016 11:16:13 -0400 (EDT) Original-Received: from clucks (unknown [88.160.190.192]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by pb-sasl2.pobox.com (Postfix) with ESMTPSA id 733EB233B5; Mon, 20 Jun 2016 11:16:12 -0400 (EDT) In-Reply-To: (Ben Rocer's message of "Mon, 28 Jul 2014 16:35:15 +0200") User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) X-Pobox-Relay-ID: ECB1A1FC-36F9-11E6-82CD-28A6F1301B6D-02397024!pb-sasl2.pobox.com X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 208.118.235.43 X-BeenThere: bug-guile@gnu.org List-Id: "Bug reports for GUILE, GNU's Ubiquitous Extension Language" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guile-bounces+guile-bugs=m.gmane.org@gnu.org Original-Sender: "bug-guile" Xref: news.gmane.org gmane.lisp.guile.bugs:8021 Archived-At: Hi! Thank you very much for the bug report and fix! Applied to master, will be part of 2.1.4. Cheers, Andy On Mon 28 Jul 2014 16:35, "Ben Rocer" writes: > [resubmitting to bug-guile@gnu.org as debbugs seems to have eaten my > first mail] > > When I tried to reproduce this bug on a 32-bit x86 system, I got an > abort in the function bytevector_large_set(); I think this is also > where the bug is. > > Specifically, there are two bugs in these two consecutive lines in > bytevector_large_set(): > > value_size = (mpz_sizeinbase (c_mpz, 2) + (8 * c_size)) / (8 * c_size); > if (SCM_UNLIKELY (value_size > c_size)) > > In the first line, there is an off-by-one error in the calculation of > value_size; it gives the wrong answer if mpz_sizeinbase() is a > multiple of (8 * c_size) (see > https://gmplib.org/manual/Integer-Import-and-Export.html). > > Secondly, this calculation gives the number of (c_size-byte) *words* > required to hold c_mpz, not the number of bytes. So the check in the > next line should be (c_size * value_size > c_size), or equivalently > (value_size > 1). > > Since bytevector-u64-set! also calls bytevector_large_set, it > may be possible to reproduce this bug on 64 bit systems too; e.g > (bytevector-u64-set! (make-bytevector 8) 0 (expt 2 64) (endianness big)) > [untested] > > > --- a/libguile/bytevectors.c > +++ b/libguile/bytevectors.c > @@ -867,10 +867,10 @@ bytevector_large_set (char *c_bv, size_t c_size, int signed_p, > memset (c_bv, 0, c_size); > else > { > - size_t word_count, value_size; > + size_t word_count, value_words; > > - value_size = (mpz_sizeinbase (c_mpz, 2) + (8 * c_size)) / (8 * c_size); > - if (SCM_UNLIKELY (value_size > c_size)) > + value_words = (mpz_sizeinbase (c_mpz, 2) + (8 * c_size) - 1) / (8 * c_size); > + if (SCM_UNLIKELY (value_words > 1)) > { > err = -2; > goto finish;