Subject: bug#14917: closed (Re: bug#14917: Missing range check in fxcopy-bit can give SIGABRT)

From: [email-masked] (GNU bug Tracking System)
Date: Tue, 21 Jun 2016 07:36:01 +0000

Your bug report

#14917: Missing range check in fxcopy-bit can give SIGABRT

which was filed against the guile package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
14917: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=14917
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#14917: Missing range check in fxcopy-bit can give SIGABRT
From: Andy Wingo <[email-masked]>
To: Göran Weinholt <[email-masked]>
Cc: [email-masked]
Date: Tue, 21 Jun 2016 09:35:44 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Howdy :)

Three years later, this is now fixed and will be in 2.1.4.  I think
we'll cherry-pick it back to 2.0.12 too.

Cheers,

Andy

On Sat 20 Jul 2013 08:57, Göran Weinholt <[email-masked]> writes:

> Hello schemers,
>
> the fxcopy-bit procedure from (rnrs) is missing some range checks. It
> can return a non-fixnum:
>
> scheme@(guile-user)> (import (rnrs))
> scheme@(guile-user)> (fxcopy-bit 0 (fixnum-width) 1)
> $1 = 9223372036854775808
>
> It can also crash the guile process, which is somewhat surprising for a
> fixnum procedure:
>
> scheme@(guile-user)> (import (rnrs))
> scheme@(guile-user)> (fxcopy-bit 0 100000000000 0)
> FATAL: memory error in realloc
> Aborted
>
> Here's an alternative error message:
>
> scheme@(guile-user)> (import (rnrs))
> scheme@(guile-user)> (fxcopy-bit 0 1000000000000 0)
> gmp: overflow in mpz type
> Aborted
>
> Other implementations of fxcopy-bit usually check that the third
> argument is 0 or 1, but I'm not sure that is required.
>
> There's also a bitwise-copy-bit procedure that is similary affected.
> Tested with Guile 2.0.9.40-824b-dirty on an amd64 system.
>
> Regards,

Subject: Missing range check in fxcopy-bit can give SIGABRT
From: Göran Weinholt <[email-masked]>
To: [email-masked]
Date: Sat, 20 Jul 2013 08:57:29 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello schemers,

the fxcopy-bit procedure from (rnrs) is missing some range checks. It
can return a non-fixnum:

scheme@(guile-user)> (import (rnrs))
scheme@(guile-user)> (fxcopy-bit 0 (fixnum-width) 1)
$1 = 9223372036854775808

It can also crash the guile process, which is somewhat surprising for a
fixnum procedure:

scheme@(guile-user)> (import (rnrs))
scheme@(guile-user)> (fxcopy-bit 0 100000000000 0)
FATAL: memory error in realloc
Aborted

Here's an alternative error message:

scheme@(guile-user)> (import (rnrs))
scheme@(guile-user)> (fxcopy-bit 0 1000000000000 0)
gmp: overflow in mpz type
Aborted

Other implementations of fxcopy-bit usually check that the third
argument is 0 or 1, but I'm not sure that is required.

There's also a bitwise-copy-bit procedure that is similary affected.
Tested with Guile 2.0.9.40-824b-dirty on an amd64 system.

Regards,

-- 
Göran Weinholt <[email-masked]>
"Mr. Crane, please remember you're not required to answer any of
Lt. Tragg's questions. As a matter of fact, don't even discuss the
weather with him, he can be very persuasive." -- Perry Mason