| Summary: | Integer overflow in sched.h cpu set CPU_* macros | ||
|---|---|---|---|
| Product: | glibc | Reporter: | Rich Felker <bugdal> |
| Component: | libc | Assignee: | Andreas Jaeger <aj> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | aj, drepper.fsp, fweimer |
| Priority: | P2 | Flags: | fweimer:
security?
|
| Version: | unspecified | ||
| Target Milestone: | 2.18 | ||
| Host: | Target: | ||
| Build: | Last reconfirmed: | ||
This is fixed now for glibc 2.18, thanks for your report. commit 8a67a4b3435d8471523d3ae4f7cb46cf9b8d72d9 Author: Andreas Jaeger <aj@suse.de> Date: Fri May 10 20:28:40 2013 +0200 Fix integer overflow in sysdeps/unix/sysv/linux/bits/sched.h [BZ #15448] * sysdeps/unix/sysv/linux/bits/sched.h (__CPU_SET_S) (__CPU_CLR_S, __CPU_ISSET_S): Avoid integer overflow. |
In file sysdeps/unix/sysv/linux/bits/sched.h, the cpu set macros attempt to check for overflow of the cpu index, but fail to do so properly due to an integer overflow error. The condition: 147 __cpu < 8 * (setsize) overflows if setsize is greater than SIZE_MAX/8. The correct test would be: __cpu/8 < (setsize) which is valid since the low 3 bits of __cpu are irrelevant to whether the index overflows.