Re: Shift out of bounds in coreutils-6.11

[Eric Blake]

[adding the public list]

On 12/03/2014 10:49 AM, Dingbao Xie wrote:
> Dear coreutils maintainer,
> I'm a visiting phd student at UC davis and currently works
> on a project aiming to detect undefined behaviors.
> clang has a sanitizer called ubsan which can identify certain
> undefined behaviors at runtime. I tried to do experiment on coreutils
> and found a shift out of bounds in a c file.
> Below is the detail information:
> 
> xdb@xie:$ ./arch _<<<\x00
> ../../lib/quotearg.c:554:45: runtime error: left shift of 1 by 31 places
> cannot be represented in type 'int'
> ./arch: extra operand `_'
> Try `./arch --help' for more information
> 
> 
> Could you please confirm that whether it is a serious problem or not?
> BTW, I built coreutil-6.11 with clang (-fsanitize=undefined).

Thanks for the report.  This issue has already been fixed upstream;
http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=831b84, and is
already in newer versions of coreutils.  You would be much better off
doing your testing on the latest coreutils.git instead of old versions.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

signature.asc
Description: OpenPGP digital signature