git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 2/4] shallow.c: avoid theoretical pointer wrap-around

From
Jeff King <peff@peff.net>
Date
Dec 3, 2016, 05:17 UTC
Message-ID
<20161203051720.z5elgoaapulqxlw5@sigill.intra.peff.net>
In-Reply-To
<1480710664-26290-2-git-send-email-rv@rasmusvillemoes.dk>
On Fri, Dec 02, 2016 at 09:31:02PM +0100, Rasmus Villemoes wrote:
Show 15 quoted lines
> The expression info->free+size is technically undefined behaviour in
> exactly the case we want to test for. Moreover, the compiler is likely
> to translate the expression to
> 
>   (unsigned long)info->free + size > (unsigned long)info->end
> 
> where there's at least a theoretical chance that the LHS could wrap
> around 0, giving a false negative.
> 
> This might as well be written using pointer subtraction avoiding these
> issues.
> [...]
>
> -	if (!info->slab_count || info->free + size > info->end) {
> +	if (!info->slab_count || size > info->end - info->free) {

Yeah, I agree the correct way to write this is to compare the sizes directly. That is how overflow checks _must_ be written. This one is less likely to overflow, but even computing the value more than one past the end of the array is technically undefined.

-Peff
Previous: Rasmus VillemoesNext: Rasmus Villemoes
Message 3 of 20 in “shallow.c: make paint_alloc slightly more robust”
  1. 1/4 shallow.c: make paint_alloc slightly more robustRasmus Villemoes, Dec 2, 2016
  2. 2/4 shallow.c: avoid theoretical pointer wrap-aroundRasmus Villemoes, Dec 2, 2016
  3. Jeff KingDec 3, 2016
  4. 3/4 shallow.c: bit manipulation tweaksRasmus Villemoes, Dec 2, 2016
  5. Jeff KingDec 3, 2016
  6. 4/4 shallow.c: remove useless testRasmus Villemoes, Dec 2, 2016
  7. Jeff KingDec 3, 2016
  8. Duy NguyenDec 5, 2016
  9. Jeff KingDec 3, 2016
  10. Duy NguyenDec 5, 2016
  11. 0/6 shallow.c improvementsNguyễn Thái Ngọc Duy, Dec 6, 2016
  12. 1/6 shallow.c: rename fields in paint_info to better express their purposesNguyễn Thái Ngọc Duy, Dec 6, 2016
  13. 5/6 shallow.c: bit manipulation tweaksNguyễn Thái Ngọc Duy, Dec 6, 2016
  14. 4/6 shallow.c: avoid theoretical pointer wrap-aroundNguyễn Thái Ngọc Duy, Dec 6, 2016
  15. 6/6 shallow.c: remove useless codeNguyễn Thái Ngọc Duy, Dec 6, 2016
  16. 3/6 shallow.c: make paint_alloc slightly more robustNguyễn Thái Ngọc Duy, Dec 6, 2016
  17. 2/6 shallow.c: stop abusing COMMIT_SLAB_SIZE for paint_info's memory poolsNguyễn Thái Ngọc Duy, Dec 6, 2016
  18. Jeff KingDec 6, 2016
  19. Duy NguyenDec 6, 2016
  20. Junio C HamanoDec 7, 2016

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.