bug#13827: faulty range check in bytevector accessor

[Andy Wingo]

On Wed 27 Feb 2013 03:02, Ian Price <address@hidden> writes:

> Branch: master
> Commit: 9b977c836bf147d386944c401113aba32776fa68
> System: 32 bit x86 Fedora 16
>
> (use-modules (rnrs bytevectors))
> (define not-32-bit (expt 2 32))
> (define bv (make-bytevector 4))
> (bytevector-u32-set! bv 0 not-32-bit (endianness big))
> (pk bv)
>
> Running this gives me a core dump. It happens for a wide range of values
> that don't fit in 32 bits.
>
> After some talk on #guile, Mark and I believe it comes down to the range
> check in INTEGER_ACCESSOR_PROLOGUE in bytevectors.c

Something like this look right to you?

--- a/libguile/bytevectors.c
+++ b/libguile/bytevectors.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2009, 2010, 2011, 2012 Free Software Foundation, Inc.
+/* Copyright (C) 2009, 2010, 2011, 2012, 2013 Free Software Foundation, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public License
@@ -82,12 +82,12 @@
   _sign char *c_bv;                                            \
                                                                \
   SCM_VALIDATE_BYTEVECTOR (1, bv);                             \
-  c_index = scm_to_uint (index);                               \
+  c_index = scm_to_size_t (index);                             \
                                                                \
   c_len = SCM_BYTEVECTOR_LENGTH (bv);                          \
   c_bv = (_sign char *) SCM_BYTEVECTOR_CONTENTS (bv);          \
                                                                \
-  if (SCM_UNLIKELY (c_index + ((_len) >> 3UL) - 1 >= c_len))   \
+  if (SCM_UNLIKELY (c_index >= c_len))                          \
     scm_out_of_range (FUNC_NAME, index);
 
 /* Template for fixed-size integer access (only 8, 16 or 32-bit).  */



-- 
http://wingolog.org/