Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix various UndefinedBehaviorSanitizer warnings #315

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Fix various UndefinedBehaviorSanitizer warnings #315

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
1566691
Fix bzcat UBSan false positives for base and limit.
ccawley2011 Jan 16, 2022
5a850bf
Fix "applying offset to null pointer" warnings with UBSan
ccawley2011 Jan 16, 2022
31c5747
Fix "index 4096 out of bounds" warnings with UBSan
ccawley2011 Jan 16, 2022
814ed78
Fix "null pointer passed as argument 1, which is declared to never be…
ccawley2011 Jan 16, 2022
a1e24fa
Fix "signed integer overflow" warning with UBSan
ccawley2011 Jan 16, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,9 @@ void toy_init(struct toy_list *which, char *argv[])

// Free old toys contents (to be reentrant), but leave rebound if any
// don't blank old optargs if our new argc lives in the old optargs.
if (argv<toys.optargs || argv>toys.optargs+toys.optc) free(toys.optargs);
if (toys.optargs) {
if (argv<toys.optargs || argv>toys.optargs+toys.optc) free(toys.optargs);
}
memset(&toys, 0, offsetof(struct toy_context, rebound));
if (oldwhich) memset(&this, 0, sizeof(this));

Expand Down
5 changes: 4 additions & 1 deletion toys/lsb/seq.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,10 @@ static double parsef(char *s)
{
char *dp = strchr(s, '.');

if (dp++) TT.precision = maxof(TT.precision, strcspn(dp, "eE"));
if (dp) {
dp++;
TT.precision = maxof(TT.precision, strcspn(dp, "eE"));
}

return xstrtod(s);
}
Expand Down
6 changes: 5 additions & 1 deletion toys/other/blkid.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,10 @@ static void do_blkid(int fd, char *name)
pass++;
continue;
}
if (fstypes[i].magic_len+fstypes[i].magic_offset-off > sizeof(toybuf)) {
pass++;
continue;
}
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which entry in fs_types[] has magic/len straddle a 4k boundary? We're supplying the input data here, it's a known set of table entries, the test above this is "we haven't advanced into this block yet", and quite intentionally none of the regions it needs to probe are across a 4k boundary.

Maybe I'm missing something, but... how can this trigger?

if (fstypes[i].magic_offset < off) continue;

// Populate 64 bit little endian magic value
Expand Down Expand Up @@ -141,7 +145,7 @@ static void do_blkid(int fd, char *name)

len = fstypes[i].label_len;
if (!FLAG(U) && len) {
s = toybuf+fstypes[i].label_off-off;
s = toybuf+(fstypes[i].label_off-off);
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this changes the result of the computation, I'm pretty sure that would be a compiler bug?

if (!strcmp(type, "vfat")) {
show_tag("SEC_TYPE", "msdos");
while (len && s[len-1]==' ') len--;
Expand Down
35 changes: 14 additions & 21 deletions toys/other/bzcat.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,9 @@ config BZCAT

// This is what we know about each huffman coding group
struct group_data {
int limit[MAX_HUFCODE_BITS+1], base[MAX_HUFCODE_BITS], permute[MAX_SYMBOLS];
// limit and base are 1-indexed. index 0 is never used but increasing
// the length by 1 simplifies the code and isn't that much of a waste.
int limit[1+MAX_HUFCODE_BITS+1], base[1+MAX_HUFCODE_BITS], permute[MAX_SYMBOLS];
char minLen, maxLen;
};

Expand Down Expand Up @@ -124,7 +126,7 @@ static unsigned int get_bits(struct bunzip_data *bd, char bits_wanted)

// Avoid 32-bit overflow (dump bit buffer to top of output)
if (bd->inbufBitCount>=24) {
bits = bd->inbufBits&((1<<bd->inbufBitCount)-1);
bits = bd->inbufBits&((1u<<bd->inbufBitCount)-1);
bits_wanted -= bd->inbufBitCount;
bits <<= bits_wanted;
bd->inbufBitCount = 0;
Expand Down Expand Up @@ -161,7 +163,7 @@ static unsigned int get_bits(struct bunzip_data *bd, char bits_wanted)
static int read_block_header(struct bunzip_data *bd, struct bwdata *bw)
{
struct group_data *hufGroup;
int hh, ii, jj, kk, symCount, *base, *limit;
int hh, ii, jj, kk, symCount;
unsigned char uc;

// Read in header signature and CRC (which is stored big endian)
Expand Down Expand Up @@ -273,16 +275,10 @@ static int read_block_header(struct bunzip_data *bd, struct bwdata *bw)
hufGroup->minLen = minLen;
hufGroup->maxLen = maxLen;

// Note that minLen can't be smaller than 1, so we adjust the base
// and limit array pointers so we're not always wasting the first
// entry. We do this again when using them (during symbol decoding).
base = hufGroup->base-1;
limit = hufGroup->limit-1;

// zero temp[] and limit[], and calculate permute[]
pp = 0;
for (ii = minLen; ii <= maxLen; ii++) {
temp[ii] = limit[ii] = 0;
temp[ii] = hufGroup->limit[ii] = 0;
for (hh = 0; hh < symCount; hh++)
if (length[hh] == ii) hufGroup->permute[pp++] = hh;
}
Expand All @@ -297,13 +293,13 @@ static int read_block_header(struct bunzip_data *bd, struct bwdata *bw)
pp = hh = 0;
for (ii = minLen; ii < maxLen; ii++) {
pp += temp[ii];
limit[ii] = pp-1;
hufGroup->limit[ii] = pp-1;
pp <<= 1;
base[ii+1] = pp-(hh+=temp[ii]);
hufGroup->base[ii+1] = pp-(hh+=temp[ii]);
}
limit[maxLen] = pp+temp[maxLen]-1;
limit[maxLen+1] = INT_MAX;
base[minLen] = 0;
hufGroup->limit[maxLen] = pp+temp[maxLen]-1;
hufGroup->limit[maxLen+1] = INT_MAX;
hufGroup->base[minLen] = 0;
}

return 0;
Expand All @@ -320,7 +316,7 @@ static int read_huffman_data(struct bunzip_data *bd, struct bwdata *bw)
{
struct group_data *hufGroup;
int ii, jj, kk, runPos, dbufCount, symCount, selector, nextSym,
*byteCount, *base, *limit;
*byteCount;
unsigned hh, *dbuf = bw->dbuf;
unsigned char uc;

Expand All @@ -340,7 +336,6 @@ static int read_huffman_data(struct bunzip_data *bd, struct bwdata *bw)
// linearly, staying in cache more, so isn't as limited by DRAM access.)
runPos = dbufCount = symCount = selector = 0;
// Some unnecessary initializations to shut gcc up.
base = limit = 0;
hufGroup = 0;
hh = 0;

Expand All @@ -351,14 +346,12 @@ static int read_huffman_data(struct bunzip_data *bd, struct bwdata *bw)
symCount = GROUP_SIZE-1;
if (selector >= bd->nSelectors) return RETVAL_DATA_ERROR;
hufGroup = bd->groups + bd->selectors[selector++];
base = hufGroup->base-1;
limit = hufGroup->limit-1;
}

// Read next huffman-coded symbol (into jj).
ii = hufGroup->minLen;
jj = get_bits(bd, ii);
while (jj > limit[ii]) {
while (jj > hufGroup->limit[ii]) {
// if (ii > hufGroup->maxLen) return RETVAL_DATA_ERROR;
ii++;

Expand All @@ -369,7 +362,7 @@ static int read_huffman_data(struct bunzip_data *bd, struct bwdata *bw)
jj = (jj << 1) | kk;
}
// Huffman decode jj into nextSym (with bounds checking)
jj-=base[ii];
jj-=hufGroup->base[ii];

if (ii > hufGroup->maxLen || (unsigned)jj >= MAX_SYMBOLS)
return RETVAL_DATA_ERROR;
Expand Down
2 changes: 1 addition & 1 deletion toys/posix/ls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -315,7 +315,7 @@ static void listfiles(int dirfd, struct dirtree *indir)
if (!FLAG(f)) {
unsigned long long blocks = 0;

qsort(sort, dtlen, sizeof(void *), (void *)compare);
if (dtlen > 0) qsort(sort, dtlen, sizeof(void *), (void *)compare);
for (ul = 0; ul<dtlen; ul++) {
entrylen(sort[ul], len);
for (width = 0; width<8; width++)
Expand Down