threads / patch / 51326

patchwrapper: avoid UB in macOS

Subject: [PATCH] wrapper: avoid UB in macOS

## tl;dr

2 messages between Jun 16, 2019 and Jun 19, 2019. Diffs are folded; open one to read it.

replies: 1people: 2as markdown or json

Carlo Marcelo Arenas Belón· Jun 16, 2019, 18:40 UTC · lore

0620b39b3b ("compat: add a mkstemps() compatibility function", 2009-05-31) included a function based on code from libiberty which would result in undefined behaviour in platforms where timeval's tv_usec is a 32-bit signed type as shown by:

wrapper.c:505:31: runtime error: left shift of 594546 by 16 places cannot be represented in type '__darwin_suseconds_t' (aka 'int')

interestingly the version of this code from gcc never had this bug and the code had a cast that would had prevented the issue (at least in 64-bit platforms) but was misapplied.

change the cast to uint64_t so it also works in 32-bit platforms.

Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com>
---
 wrapper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Show changes to wrapper.c +1 −1

diff --git a/wrapper.c b/wrapper.c
index ea3cf64d4c..1e45ab7b92 100644
--- a/wrapper.c
+++ b/wrapper.c
@@ -502,7 +502,7 @@ int git_mkstemps_mode(char *pattern, int suffix_len, int mode)
 	 * Try TMP_MAX different filenames.
 	 */
 	gettimeofday(&tv, NULL);
-	value = ((size_t)(tv.tv_usec << 16)) ^ tv.tv_sec ^ getpid();
+	value = ((uint64_t)tv.tv_usec << 16) ^ tv.tv_sec ^ getpid();
 	filename_template = &pattern[len - 6 - suffix_len];
 	for (count = 0; count < TMP_MAX; ++count) {
 		uint64_t v = value;

-- 
2.22.0

Junio C Hamano· Jun 19, 2019, 14:40 UTC · re: Carlo Marcelo Arenas Belón · lore

Re: [PATCH] wrapper: avoid UB in macOS

Carlo Marcelo Arenas Belón  <carenas@gmail.com> writes:

Show 6 quoted lines

> 0620b39b3b ("compat: add a mkstemps() compatibility function", 2009-05-31)
> included a function based on code from libiberty which would result in
> undefined behaviour in platforms where timeval's tv_usec is a 32-bit signed
> type as shown by:
>
> wrapper.c:505:31: runtime error: left shift of 594546 by 16 places cannot be represented in type '__darwin_suseconds_t' (aka 'int')

I had to scratch my head wondering what an UB was (spell it out as "undefined behaviour" if that is what you wanted to say).

Show 5 quoted lines

> interestingly the version of this code from gcc never had this bug and the
> code had a cast that would had prevented the issue (at least in 64-bit
> platforms) but was misapplied.
>
> change the cast to uint64_t so it also works in 32-bit platforms.

Yup, regardless of the platform, that's the "right" type to use, certainly more correct than "size_t", as value is declared to be u64 in this function.

Show 6 quoted lines

>  	gettimeofday(&tv, NULL);
> -	value = ((size_t)(tv.tv_usec << 16)) ^ tv.tv_sec ^ getpid();
> +	value = ((uint64_t)tv.tv_usec << 16) ^ tv.tv_sec ^ getpid();
>  	filename_template = &pattern[len - 6 - suffix_len];
>  	for (count = 0; count < TMP_MAX; ++count) {
>  		uint64_t v = value;

Thanks.