GNU bug report logs - #14917
Missing range check in fxcopy-bit can give SIGABRT

Previous Next

Full log

Message #10 received at 14917-done <at> debbugs.gnu.org (full text, mbox):

From: Andy Wingo <wingo <at> pobox.com>
To: Göran Weinholt <goran <at> weinholt.se>
Cc: 14917-done <at> debbugs.gnu.org
Subject: Re: bug#14917: Missing range check in fxcopy-bit can give SIGABRT
Date: Tue, 21 Jun 2016 09:35:44 +0200

Howdy :)

Three years later, this is now fixed and will be in 2.1.4.  I think
we'll cherry-pick it back to 2.0.12 too.

Cheers,

Andy

On Sat 20 Jul 2013 08:57, Göran Weinholt <goran <at> weinholt.se> writes:

> Hello schemers,
>
> the fxcopy-bit procedure from (rnrs) is missing some range checks. It
> can return a non-fixnum:
>
> scheme@(guile-user)> (import (rnrs))
> scheme@(guile-user)> (fxcopy-bit 0 (fixnum-width) 1)
> $1 = 9223372036854775808
>
> It can also crash the guile process, which is somewhat surprising for a
> fixnum procedure:
>
> scheme@(guile-user)> (import (rnrs))
> scheme@(guile-user)> (fxcopy-bit 0 100000000000 0)
> FATAL: memory error in realloc
> Aborted
>
> Here's an alternative error message:
>
> scheme@(guile-user)> (import (rnrs))
> scheme@(guile-user)> (fxcopy-bit 0 1000000000000 0)
> gmp: overflow in mpz type
> Aborted
>
> Other implementations of fxcopy-bit usually check that the third
> argument is 0 or 1, but I'm not sure that is required.
>
> There's also a bitwise-copy-bit procedure that is similary affected.
> Tested with Guile 2.0.9.40-824b-dirty on an amd64 system.
>
> Regards,

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.