[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#14917: Missing range check in fxcopy-bit can give SIGABRT
From: |
Andy Wingo |
Subject: |
bug#14917: Missing range check in fxcopy-bit can give SIGABRT |
Date: |
Tue, 21 Jun 2016 09:35:44 +0200 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) |
Howdy :)
Three years later, this is now fixed and will be in 2.1.4. I think
we'll cherry-pick it back to 2.0.12 too.
Cheers,
Andy
On Sat 20 Jul 2013 08:57, Göran Weinholt <address@hidden> writes:
> Hello schemers,
>
> the fxcopy-bit procedure from (rnrs) is missing some range checks. It
> can return a non-fixnum:
>
> scheme@(guile-user)> (import (rnrs))
> scheme@(guile-user)> (fxcopy-bit 0 (fixnum-width) 1)
> $1 = 9223372036854775808
>
> It can also crash the guile process, which is somewhat surprising for a
> fixnum procedure:
>
> scheme@(guile-user)> (import (rnrs))
> scheme@(guile-user)> (fxcopy-bit 0 100000000000 0)
> FATAL: memory error in realloc
> Aborted
>
> Here's an alternative error message:
>
> scheme@(guile-user)> (import (rnrs))
> scheme@(guile-user)> (fxcopy-bit 0 1000000000000 0)
> gmp: overflow in mpz type
> Aborted
>
> Other implementations of fxcopy-bit usually check that the third
> argument is 0 or 1, but I'm not sure that is required.
>
> There's also a bitwise-copy-bit procedure that is similary affected.
> Tested with Guile 2.0.9.40-824b-dirty on an amd64 system.
>
> Regards,
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- bug#14917: Missing range check in fxcopy-bit can give SIGABRT,
Andy Wingo <=