lib: vsprintf: fix invalid arg check

PATCH In review Vasiliy Kulikov 3 participants 8 messages Nov 10, 2010 – Nov 12, 2010

Subsystems (3)

Kernel janitors Library code Vsprintf

lore

Share & tools

lore

Vasiliy Kulikov

author

2010-11-10 20:38 UTC #0 lore raw

PATCH 1/1 lib: vsprintf: fix invalid arg check

"size" is size_t. If we want to check whether it was underflowed then we should cast it to ssize_t instead of int. When sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow, but it is not.

Signed-off-by Vasiliy Kulikov <[email protected]>

---
Compile tested.

 lib/vsprintf.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

lib/vsprintf.c +1 -1

index c150d3d..e7cf674 100644
@@ -1290,7 +1290,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
 
 	/* Reject out-of-range values early.  Large positive sizes are
 	   used for unknown buffer sizes. */
-	if (WARN_ON_ONCE((int) size < 0))
+	if (WARN_ON_ONCE((ssize_t) size < 0))
 		return 0;
 
 	str = buf;

Signature · 1 line

1.7.0.4

Andrew Morton

maintainer

2010-11-10 21:08 UTC #1 lore raw

Quoted 5 lines · On Wed, 10 Nov 2010 23:38:08 +0300 Vasiliy Kulikov <[email protected]> wrote:

"size" is size_t. If we want to check whether it was underflowed then we should cast it to ssize_t instead of int. When sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow, but it is not.

Does this patch fix any actual observed problem?

Quoted 2 lines

Compile tested.

I guess not.

lib/vsprintf.c int vsnprintf(char *buf, size_t size, const char *fmt, va_list args) · line 1292

Quoted 6 lines

lib/vsprintf.c +0 -0

@@ -1290,7 +1290,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
 
 	/* Reject out-of-range values early.  Large positive sizes are
 	   used for unknown buffer sizes. */

Thousands of people would find that comment to be utterly mysterious. I am one.

Quoted 5 lines

lib/vsprintf.c +1 -1

-	if (WARN_ON_ONCE((int) size < 0))
+	if (WARN_ON_ONCE((ssize_t) size < 0))
 		return 0;
 
 	str = buf;

David Rientjes

2010-11-10 21:38 UTC #2 lore raw

Quoted 17 lines · Andrew Morton

Quoted 5 lines
"size" is size_t. If we want to check whether it was underflowed then we should cast it to ssize_t instead of int. When sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow, but it is not.
Does this patch fix any actual observed problem?
Quoted 2 lines
Compile tested.
I guess not.
Quoted 4 lines
lib/vsprintf.c +0 -0
@@ -1290,7 +1290,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
 

Quoted 6 lines

lib/vsprintf.c int vsnprintf(char *buf, size_t size, const char *fmt, va_list args) · line 1292
Quoted 2 lines
lib/vsprintf.c +0 -0
 	/* Reject out-of-range values early.  Large positive sizes are
 	   used for unknown buffer sizes. */
Thousands of people would find that comment to be utterly mysterious. I am one.

vsprintf() and sprintf() pass INT_MAX for an unbounded buffer length, so the cast to int here in the original code is correct. The type of interest is not of the passed size, but rather the return value of the
function. The changelog is wrong: if sizeof(size_t) > sizeof(int) then
the return value overflows.

Quoted 5 lines

lib/vsprintf.c +1 -1

-	if (WARN_ON_ONCE((int) size < 0))
+	if (WARN_ON_ONCE((ssize_t) size < 0))
 		return 0;
 
 	str = buf;

Vasiliy Kulikov

author

2010-11-11 08:34 UTC #3 lore raw

Quoted 9 lines · David Rientjes

Quoted 7 lines · Andrew Morton
Quoted 5 lines
"size" is size_t. If we want to check whether it was underflowed then we should cast it to ssize_t instead of int. When sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow, but it is not.
Does this patch fix any actual observed problem?

I don't think so, this fix is more theoretical than practical. However, maybe there is some crazy driver that fills array of 2GB with s*printf().

Quoted 4 lines

Quoted 4 lines
Quoted 2 lines
Compile tested.
I guess not.

What do you mean here?

$ make lib/vsprintf.o
  CHK     include/linux/version.h
  CHK     include/generated/utsrelease.h
  CALL    scripts/checksyscalls.sh
  CC      lib/vsprintf.o

Compiled without warnings.

Quoted 6 lines

Quoted 6 lines
lib/vsprintf.c int vsnprintf(char *buf, size_t size, const char *fmt, va_list args) · line 1292
Quoted 2 lines
lib/vsprintf.c +0 -0
 	/* Reject out-of-range values early.  Large positive sizes are
 	   used for unknown buffer sizes. */
Thousands of people would find that comment to be utterly mysterious. I am one.

[...]

Quoted 1 line

The changelog is wrong: if sizeof(size_t) > sizeof(int) then the return value overflows.

This comparison is intended for size_t _underflow_, e.g. in such (buggy) code:

len = snprintf(buf, sizeof(buf), "%s", string);
len += snprintf(buf + len, sizeof(buf) - len, "%s", string2);

If the first snprintf() returns len that is greater than sizeof(buf), then sizeof(buf)-len is negative; casted to (unsigned!) size_t it becomes some big value. buf+len points to somewhere after the real buf.

To detect this situation we check whether size is negative (as signed). But it should be checked as integer of the same size.

Quoted 1 line

vsprintf() and sprintf() pass INT_MAX for an unbounded buffer length

OK, this should be changed to LONG_MAX.

Quoted 2 lines

The type of interest is not of the passed size, but rather the return value of the function.

From vsnprintf comment:

* The return value is the number of characters which would
* be generated for the given input, excluding the trailing

If nothing was filled then result is zero.

Quoted 6 lines

lib/vsprintf.c +1 -1

-	if (WARN_ON_ONCE((int) size < 0))
+	if (WARN_ON_ONCE((ssize_t) size < 0))
 		return 0;
 
 	str = buf;

Signature · 1 line

Vasiliy

David Rientjes

2010-11-11 20:38 UTC #4 lore raw

Quoted 6 lines · Vasiliy Kulikov

Quoted 6 lines
Quoted 6 lines
Quoted 5 lines
"size" is size_t. If we want to check whether it was underflowed then we should cast it to ssize_t instead of int. When sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow, but it is not.

Quoted 6 lines

Quoted 1 line
Quoted 1 line
Does this patch fix any actual observed problem?
I don't think so, this fix is more theoretical than practical. However, maybe there is some crazy driver that fills array of 2GB with s*printf().

All sizes passed to vsprintf() greater than INT_MAX are invalid; that's what the original code is testing, warning, and handling correctly.

Quoted 7 lines

Quoted 4 lines
Quoted 4 lines
Quoted 2 lines
Compile tested.
I guess not.
What do you mean here?

Quoted 8 lines

$ make lib/vsprintf.o
  CHK     include/linux/version.h
  CHK     include/generated/utsrelease.h
  CALL    scripts/checksyscalls.sh
  CC      lib/vsprintf.o

Compiled without warnings.

Andrew was commenting that this was the only additional information you provided instead of showing a working example.

Quoted 6 lines

Quoted 6 lines
Quoted 6 lines
lib/vsprintf.c int vsnprintf(char *buf, size_t size, const char *fmt, va_list args) · line 1292
Quoted 2 lines
lib/vsprintf.c +0 -0
 	/* Reject out-of-range values early.  Large positive sizes are
 	   used for unknown buffer sizes. */
Thousands of people would find that comment to be utterly mysterious. I am one.

Quoted 9 lines

[...]
Quoted 1 line
The changelog is wrong: if sizeof(size_t) > sizeof(int) then the return value overflows.
This comparison is intended for size_t _underflow_, e.g. in such (buggy) code:
len = snprintf(buf, sizeof(buf), "%s", string);
len += snprintf(buf + len, sizeof(buf) - len, "%s", string2);

That's buggy because len may be greater than sizeof(buf). snprintf() returns the number of characters that would have been generated if it wasn't truncated so that we can test that value upon return.

Quoted 4 lines

If the first snprintf() returns len that is greater than sizeof(buf), then sizeof(buf)-len is negative; casted to (unsigned!) size_t it becomes some big value. buf+len points to somewhere after the real buf.

Right, that's the behavior of snprintf(), but that doesn't mean the passed size can be anything larger than INT_MAX.

Quoted 7 lines

To detect this situation we check whether size is negative (as signed). But it should be checked as integer of the same size.
Quoted 1 line
vsprintf() and sprintf() pass INT_MAX for an unbounded buffer length
OK, this should be changed to LONG_MAX.

No, it shouldn't, these functions return int. INT_MAX is the largest value we can handle successfully and that's why it is the special case for sprintf() and vsprintf().

The code as it stands is correct not because of the type of the size but rather the type of the return value.

Vasiliy Kulikov

author

2010-11-11 21:02 UTC #5 lore raw

Quoted 10 lines · David Rientjes

Quoted 8 lines · Vasiliy Kulikov
Quoted 7 lines
Quoted 7 lines
Quoted 5 lines
"size" is size_t. If we want to check whether it was underflowed then we should cast it to ssize_t instead of int. When sizeof(size_t) > sizeof(int) the code sees UINT_MAX as underflow, but it is not.
Does this patch fix any actual observed problem?

Quoted 7 lines

Quoted 4 lines
I don't think so, this fix is more theoretical than practical. However, maybe there is some crazy driver that fills array of 2GB with s*printf().
All sizes passed to vsprintf() greater than INT_MAX are invalid; that's what the original code is testing, warning, and handling correctly.

Not always correctly:

(int)(0xFFFFFFFFL + 2) = 1 is positive.

Quoted 6 lines

No, it shouldn't, these functions return int. INT_MAX is the largest value we can handle successfully and that's why it is the special case for sprintf() and vsprintf().
The code as it stands is correct not because of the type of the size but rather the type of the return value.

OK, if the main reason here is return value type, then the correct handling should be:

	/* Reject out-of-range values early.  Large positive sizes are
	   used for unknown buffer sizes. */
-	if (WARN_ON_ONCE((int) size < 0))
+	if (WARN_ON_ONCE(size > INT_MAX)
		return 0;

This should catch all underflows and too big integers.

Signature · 1 line

Vasiliy

David Rientjes

2010-11-11 21:34 UTC #6 lore raw

Quoted 11 lines · Vasiliy Kulikov

OK, if the main reason here is return value type, then the correct handling should be:
	/* Reject out-of-range values early.  Large positive sizes are
	   used for unknown buffer sizes. */
(quoted diff) +1 -1
-	if (WARN_ON_ONCE((int) size < 0))
+	if (WARN_ON_ONCE(size > INT_MAX)
		return 0;
This should catch all underflows and too big integers.

That is equivalent since size_t is always unsigned; if you'd like to change it, it should be presented only as a style change. More important would be writing a less cryptic comment :)

Vasiliy Kulikov

author

2010-11-12 17:42 UTC #7 lore raw

Quoted 10 lines · David Rientjes

Quoted 9 lines · Vasiliy Kulikov
OK, if the main reason here is return value type, then the correct handling should be:
	/* Reject out-of-range values early.  Large positive sizes are
	   used for unknown buffer sizes. */
(quoted diff) +1 -1
-	if (WARN_ON_ONCE((int) size < 0))
+	if (WARN_ON_ONCE(size > INT_MAX)
		return 0;

Quoted 4 lines

Quoted 2 lines
This should catch all underflows and too big integers.
That is equivalent since size_t is always unsigned;

Not equivalent:

void test_size(size_t size)

{
    char buffer[128];
    sprintf(buffer, "size %lx is BAD", size);
    snprintf(buffer, size, "size %lx is OK", size);
    pr_info("%s\n", buffer);
    if (size > INT_MAX)
        pr_info("%lx is catched by (size) > INT_MAX", size);
}

static int init(void) {
        test_size(0x7FFFFFFF);
        test_size(0x80000000);
        test_size(0x80000001);
        test_size(0xFFFFFFFF);
        test_size(0x100000000);
        test_size(0x100000001);
        test_size(0x17fffffff);
        test_size(0x180000000);
        test_size(0x180000001);

        return 0;
}

Output on x86_64:

[12486.542047] size 7fffffff is OK
[12486.542051] size 80000000 is BAD
[12486.542053] 80000000 is catched by (size) > INT_MAX
[12486.542055] size 80000001 is BAD
[12486.542057] 80000001 is catched by (size) > INT_MAX
[12486.542059] size ffffffff is BAD
[12486.542061] ffffffff is catched by (size) > INT_MAX
[12486.542063] size 100000000 is OK
[12486.542065] 100000000 is catched by (size) > INT_MAX
[12486.542067] size 100000001 is OK
[12486.542069] 100000001 is catched by (size) > INT_MAX
[12486.542071] size 17fffffff is OK
[12486.542073] 17fffffff is catched by (size) > INT_MAX
[12486.542075] size 180000000 is BAD
[12486.542077] 180000000 is catched by (size) > INT_MAX
[12486.542079] size 180000001 is BAD
[12486.542081] 180000001 is catched by (size) > INT_MAX

Signature · 1 line

Vasiliy