[glibc/azanella/ubsan-undef] locale: Fix UB on VLA allocation

Adhemerval Zanella azanella@sourceware.org
Fri Apr 25 19:53:43 GMT 2025


https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=556b221f3d44eb1bdd322b542a2ec6cf7b11c244

commit 556b221f3d44eb1bdd322b542a2ec6cf7b11c244
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Tue Apr 22 10:50:13 2025 -0300

    locale: Fix UB on VLA allocation
    
    Both level 2 and level 3 sizes can be zero, which triggers a 0-size
    VLA.  Reorganize the code to allocate the VLA iff sizes are positive.

Diff:
---
 locale/programs/3level.h   | 74 +++++++++++++++++++++++++---------------------
 locale/programs/ld-ctype.c | 74 +++++++++++++++++++++++++---------------------
 2 files changed, 80 insertions(+), 68 deletions(-)

diff --git a/locale/programs/3level.h b/locale/programs/3level.h
index 971e0f4c4d..45ed0f15b0 100644
--- a/locale/programs/3level.h
+++ b/locale/programs/3level.h
@@ -212,58 +212,64 @@ static void
 CONCAT(add_locale_,TABLE) (struct locale_file *file, struct TABLE *t)
 {
   size_t i, j, k;
-  uint32_t reorder3[t->level3_size];
-  uint32_t reorder2[t->level2_size];
   uint32_t level2_offset, level3_offset, last_offset;
 
   /* Uniquify level3 blocks.  */
   k = 0;
-  for (j = 0; j < t->level3_size; j++)
+  if (t->level3_size > 0)
     {
-      for (i = 0; i < k; i++)
-	if (memcmp (&t->level3[i << t->p], &t->level3[j << t->p],
-		    (1 << t->p) * sizeof (ELEMENT)) == 0)
-	  break;
-      /* Relocate block j to block i.  */
-      reorder3[j] = i;
-      if (i == k)
+      uint32_t reorder3[t->level3_size];
+      for (j = 0; j < t->level3_size; j++)
 	{
-	  if (i != j)
-	    memcpy (&t->level3[i << t->p], &t->level3[j << t->p],
-		    (1 << t->p) * sizeof (ELEMENT));
-	  k++;
+	  for (i = 0; i < k; i++)
+	    if (memcmp (&t->level3[i << t->p], &t->level3[j << t->p],
+			(1 << t->p) * sizeof (ELEMENT)) == 0)
+	      break;
+	  /* Relocate block j to block i.  */
+	  reorder3[j] = i;
+	  if (i == k)
+	    {
+	      if (i != j)
+		memcpy (&t->level3[i << t->p], &t->level3[j << t->p],
+			(1 << t->p) * sizeof (ELEMENT));
+	      k++;
+	    }
 	}
+
+      for (i = 0; i < (t->level2_size << t->q); i++)
+	if (t->level2[i] != EMPTY)
+	  t->level2[i] = reorder3[t->level2[i]];
     }
   t->level3_size = k;
 
-  for (i = 0; i < (t->level2_size << t->q); i++)
-    if (t->level2[i] != EMPTY)
-      t->level2[i] = reorder3[t->level2[i]];
-
   /* Uniquify level2 blocks.  */
   k = 0;
-  for (j = 0; j < t->level2_size; j++)
+  if (t->level2_size > 0)
     {
-      for (i = 0; i < k; i++)
-	if (memcmp (&t->level2[i << t->q], &t->level2[j << t->q],
-		    (1 << t->q) * sizeof (uint32_t)) == 0)
-	  break;
-      /* Relocate block j to block i.  */
-      reorder2[j] = i;
-      if (i == k)
+      uint32_t reorder2[t->level2_size];
+      for (j = 0; j < t->level2_size; j++)
 	{
-	  if (i != j)
-	    memcpy (&t->level2[i << t->q], &t->level2[j << t->q],
-		    (1 << t->q) * sizeof (uint32_t));
-	  k++;
+	  for (i = 0; i < k; i++)
+	    if (memcmp (&t->level2[i << t->q], &t->level2[j << t->q],
+			(1 << t->q) * sizeof (uint32_t)) == 0)
+	      break;
+	  /* Relocate block j to block i.  */
+	  reorder2[j] = i;
+	  if (i == k)
+	    {
+	      if (i != j)
+		memcpy (&t->level2[i << t->q], &t->level2[j << t->q],
+			(1 << t->q) * sizeof (uint32_t));
+	      k++;
+	    }
 	}
+
+      for (i = 0; i < t->level1_size; i++)
+	if (t->level1[i] != EMPTY)
+	  t->level1[i] = reorder2[t->level1[i]];
     }
   t->level2_size = k;
 
-  for (i = 0; i < t->level1_size; i++)
-    if (t->level1[i] != EMPTY)
-      t->level1[i] = reorder2[t->level1[i]];
-
   /* Create and fill the resulting compressed representation.  */
   last_offset =
     5 * sizeof (uint32_t)
diff --git a/locale/programs/ld-ctype.c b/locale/programs/ld-ctype.c
index 15fd39c637..4e4f346f35 100644
--- a/locale/programs/ld-ctype.c
+++ b/locale/programs/ld-ctype.c
@@ -3423,58 +3423,64 @@ static void
 add_locale_wctype_table (struct locale_file *file, struct wctype_table *t)
 {
   size_t i, j, k;
-  uint32_t reorder3[t->level3_size];
-  uint32_t reorder2[t->level2_size];
   uint32_t level2_offset, level3_offset;
 
   /* Uniquify level3 blocks.  */
   k = 0;
-  for (j = 0; j < t->level3_size; j++)
+  if (t->level3_size > 0)
     {
-      for (i = 0; i < k; i++)
-	if (memcmp (&t->level3[i << t->p], &t->level3[j << t->p],
-		    (1 << t->p) * sizeof (uint32_t)) == 0)
-	  break;
-      /* Relocate block j to block i.  */
-      reorder3[j] = i;
-      if (i == k)
+      uint32_t reorder3[t->level3_size];
+      for (j = 0; j < t->level3_size; j++)
 	{
-	  if (i != j)
-	    memcpy (&t->level3[i << t->p], &t->level3[j << t->p],
-		    (1 << t->p) * sizeof (uint32_t));
-	  k++;
+	  for (i = 0; i < k; i++)
+	    if (memcmp (&t->level3[i << t->p], &t->level3[j << t->p],
+			(1 << t->p) * sizeof (uint32_t)) == 0)
+	      break;
+	  /* Relocate block j to block i.  */
+	  reorder3[j] = i;
+	  if (i == k)
+	    {
+	      if (i != j)
+		memcpy (&t->level3[i << t->p], &t->level3[j << t->p],
+			(1 << t->p) * sizeof (uint32_t));
+	      k++;
+	    }
 	}
+
+      for (i = 0; i < (t->level2_size << t->q); i++)
+	if (t->level2[i] != EMPTY)
+	  t->level2[i] = reorder3[t->level2[i]];
     }
   t->level3_size = k;
 
-  for (i = 0; i < (t->level2_size << t->q); i++)
-    if (t->level2[i] != EMPTY)
-      t->level2[i] = reorder3[t->level2[i]];
-
   /* Uniquify level2 blocks.  */
   k = 0;
-  for (j = 0; j < t->level2_size; j++)
+  if (t->level2_size > 0)
     {
-      for (i = 0; i < k; i++)
-	if (memcmp (&t->level2[i << t->q], &t->level2[j << t->q],
-		    (1 << t->q) * sizeof (uint32_t)) == 0)
-	  break;
-      /* Relocate block j to block i.  */
-      reorder2[j] = i;
-      if (i == k)
+      uint32_t reorder2[t->level2_size];
+      for (j = 0; j < t->level2_size; j++)
 	{
-	  if (i != j)
-	    memcpy (&t->level2[i << t->q], &t->level2[j << t->q],
-		    (1 << t->q) * sizeof (uint32_t));
-	  k++;
+	  for (i = 0; i < k; i++)
+	    if (memcmp (&t->level2[i << t->q], &t->level2[j << t->q],
+			(1 << t->q) * sizeof (uint32_t)) == 0)
+	      break;
+	  /* Relocate block j to block i.  */
+	  reorder2[j] = i;
+	  if (i == k)
+	    {
+	      if (i != j)
+		memcpy (&t->level2[i << t->q], &t->level2[j << t->q],
+			(1 << t->q) * sizeof (uint32_t));
+	      k++;
+	    }
 	}
+
+      for (i = 0; i < t->level1_size; i++)
+	if (t->level1[i] != EMPTY)
+	  t->level1[i] = reorder2[t->level1[i]];
     }
   t->level2_size = k;
 
-  for (i = 0; i < t->level1_size; i++)
-    if (t->level1[i] != EMPTY)
-      t->level1[i] = reorder2[t->level1[i]];
-
   t->result_size =
     5 * sizeof (uint32_t)
     + t->level1_size * sizeof (uint32_t)


More information about the Glibc-cvs mailing list