lkml.org 
[lkml]   [2017]   [Jul]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: namei_vfat.c array subscript is above array bounds
Date
Meelis Roos <mroos@linux.ee> writes:

>> Source is same with above?
>
> Yes, same checksums.

> CONFIG_X86_USE_3DNOW=y
> CONFIG_UBSAN=y
> CONFIG_UBSAN_SANITIZE_ALL=y

OK. Succeed to reproduce. gcc's ubsan (CONFIG_UBSAN_SANITIZE_ALL=y) with
CONFIG_X86_USE_3DNOW=y outputs warnings of that.

But warnings are strange. The target of source is,

vfat_create_shortname:

extlen = 0;
if (ext_start) {
for (p = ext, ip = ext_start; extlen < 3 && ip < end; ip++) {
chl = to_shortname_char(nls, charbuf, sizeof(charbuf),
ip, &ext_info);
if (chl == 0)
continue;

if ((extlen + chl) > 3) {
is_shortname = 0;
break;
}
for (chi = 0; chi < chl; chi++) {
*p++ = charbuf[chi];
extlen++;
}
if (extlen >= 3) {
if (ip + 1 != end)
is_shortname = 0;
break;
}
}
}

[...]

memcpy(name_res + 8, ext, extlen); <= here

name_res == name_res[11], but extlen never be bigger than 3 (if I'm not
missing something). And extlen is not constant, but gcc outputs the
warnings on __constant_memcpy3d().

#define memcpy(t, f, n) \
(__builtin_constant_p((n)) \
? __constant_memcpy3d((t), (f), (n)) \
: __memcpy3d((t), (f), (n)))

And changing

memcpy(name_res + 8, ext, extlen);

to

__builtin_memcpy(name_res + 8, ext, extlen);

doesn't output warnings.

So, I'm not sure though, it looks like the bug of ubsan(?). (BTW, for
now, you can set CONFIG_UBSAN_SANITIZE_ALL=n to disable ubsan.)

Thanks.
--
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>

\
 
 \ /
  Last update: 2017-07-08 09:42    [W:0.036 / U:1.276 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site