This is sources Bugzilla
Bugzilla Version 2.17.5
Bugzilla Bug 2753
  Integer overflow in bsearch Last modified: 2006-08-12 20:33:29
     Query page      Enter new bug
Bug#: 2753   Hardware:   Reporter: Robin Green <greenrd@greenrd.org>
Host: Target: Build:
Product:     Add CC:
Component:   Version:   CC:
Remove selected CCs
Status: RESOLVED   Priority:  
Resolution: WORKSFORME   Severity:  
Assigned To: Ulrich Drepper <drepper@redhat.com>   Target Milestone:  
Flags: Requestee:
  backport ()
  examined ()
  testsuite ()
Summary:
Keywords:

Attachment Description Type Created Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 2753 depends on: Show dependency tree
Show dependency graph
Bug 2753 blocks:

Additional Comments:


Leave as RESOLVED WORKSFORME
Reopen bug
Mark bug as VERIFIED

View Bug Activity   |   Format For Printing


Description:   Last confirmed: 0000-00-00 00:00 Opened: 2006-06-10 20:38
In the code for bsearch, if l and u are both very, very large, this line in
libc/stdlib/bsearch.c calculates the midpoint incorrectly due to an integer
overflow:

 idx = (l + u) / 2;

------- Additional Comment #1 From Ulrich Drepper 2006-06-13 15:27 -------
You do not even understand how binary searching works, do you?  The sum can
never exceed nmemb and nmemb obviously fits into an size_t.

------- Additional Comment #2 From Ulrich Drepper 2006-06-13 15:29 -------
I mean a valid nmemb size.  It can never be too large.  If you pass in garbage,
you get out garbage.  There is nothing wrong with that.

------- Additional Comment #3 From Robin Green 2006-06-13 17:45 -------
The point is, the sum l + u obviously can exceed nmemb, because if the
searched-for value is at the end, on the first iteration l is increased and u
stays equal to nmemb. At this point in the execution, _prior_ to dividing by 2,
integer overflow can occur.

------- Additional Comment #4 From Ulrich Drepper 2006-08-12 20:33 -------
No, l + u cannot overflow since a) arrays of 1 byte values don't make any sense
(same for 2 bytes and probably 3 bytes) and b) for every record size >= 2 we
don't overflow.  I'm not adding useless changes for bogus code.

     Query page      Enter new bug
Actions: New | Query | bug # | Reports | Requests   New Account | Log In