# [PATCH] wrapper: avoid UB in macOS 2 messages from 2019-06-16 to 2019-06-19. Participants: Carlo Marcelo Arenas Belón, Junio C Hamano. Thread: https://gitlist.dev/t/51326 ## Carlo Marcelo Arenas Belón, 2019-06-16 18:40 Subject: [PATCH] wrapper: avoid UB in macOS Message-ID: <20190616184003.17236-1-carenas@gmail.com> URL: https://gitlist.dev/e/20190616184003.17236-1-carenas%40gmail.com ``` 0620b39b3b ("compat: add a mkstemps() compatibility function", 2009-05-31) included a function based on code from libiberty which would result in undefined behaviour in platforms where timeval's tv_usec is a 32-bit signed type as shown by: wrapper.c:505:31: runtime error: left shift of 594546 by 16 places cannot be represented in type '__darwin_suseconds_t' (aka 'int') interestingly the version of this code from gcc never had this bug and the code had a cast that would had prevented the issue (at least in 64-bit platforms) but was misapplied. change the cast to uint64_t so it also works in 32-bit platforms. Signed-off-by: Carlo Marcelo Arenas Belón --- wrapper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wrapper.c b/wrapper.c index ea3cf64d4c..1e45ab7b92 100644 --- a/wrapper.c +++ b/wrapper.c @@ -502,7 +502,7 @@ int git_mkstemps_mode(char *pattern, int suffix_len, int mode) * Try TMP_MAX different filenames. */ gettimeofday(&tv, NULL); - value = ((size_t)(tv.tv_usec << 16)) ^ tv.tv_sec ^ getpid(); + value = ((uint64_t)tv.tv_usec << 16) ^ tv.tv_sec ^ getpid(); filename_template = &pattern[len - 6 - suffix_len]; for (count = 0; count < TMP_MAX; ++count) { uint64_t v = value; -- 2.22.0 ``` ## Junio C Hamano, 2019-06-19 14:40 Subject: Re: [PATCH] wrapper: avoid UB in macOS Message-ID: URL: https://gitlist.dev/e/xmqqk1dhr63n.fsf%40gitster-ct.c.googlers.com In-Reply-To: <20190616184003.17236-1-carenas@gmail.com> ``` Carlo Marcelo Arenas Belón writes: > 0620b39b3b ("compat: add a mkstemps() compatibility function", 2009-05-31) > included a function based on code from libiberty which would result in > undefined behaviour in platforms where timeval's tv_usec is a 32-bit signed > type as shown by: > > wrapper.c:505:31: runtime error: left shift of 594546 by 16 places cannot be represented in type '__darwin_suseconds_t' (aka 'int') I had to scratch my head wondering what an UB was (spell it out as "undefined behaviour" if that is what you wanted to say). > interestingly the version of this code from gcc never had this bug and the > code had a cast that would had prevented the issue (at least in 64-bit > platforms) but was misapplied. > > change the cast to uint64_t so it also works in 32-bit platforms. Yup, regardless of the platform, that's the "right" type to use, certainly more correct than "size_t", as value is declared to be u64 in this function. > gettimeofday(&tv, NULL); > - value = ((size_t)(tv.tv_usec << 16)) ^ tv.tv_sec ^ getpid(); > + value = ((uint64_t)tv.tv_usec << 16) ^ tv.tv_sec ^ getpid(); > filename_template = &pattern[len - 6 - suffix_len]; > for (count = 0; count < TMP_MAX; ++count) { > uint64_t v = value; Thanks. ```