[BZ#15448] Fix integer overflow in sysdeps/unix/sysv/linux/bits/sched.h

[Andreas Jaeger]

On 05/09/2013 04:53 PM, Will Newton wrote:
> On 9 May 2013 15:48, Andreas Jaeger <aj@suse.com> wrote:
>>
>>  From Bugzilla:
>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> In file sysdeps/unix/sysv/linux/bits/sched.h, the cpu set macros attempt to
>> check for overflow of the cpu index, but fail to do so properly due to an
>> integer overflow error. The condition:
>>
>>   147       __cpu < 8 * (setsize)
>>
>> overflows if setsize is greater than SIZE_MAX/8. The correct test would be:
>>
>>             __cpu/8 < (setsize)
>>
>> which is valid since the low 3 bits of __cpu are irrelevant to whether the
>> index overflows.
>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>
>> I've fixed all three occurences of this problem.
>>
>> Ok to commit?
>>
>> Andreas
>>
>> 2013-05-09  Andreas Jaeger  <aj@suse.de>
>>
>>          [BZ #15448]
>>          * sysdeps/unix/sysv/linux/bits/sched.h (__CPU_SET_S)
>>          (__CPU_CLR_S, __CPU_ISSET_S): Avoid integer overflow.
>>
>> diff --git a/sysdeps/unix/sysv/linux/bits/sched.h b/sysdeps/unix/sysv/linux/bits/sched.h
>> index 5e8057b..9513155 100644
>> --- a/sysdeps/unix/sysv/linux/bits/sched.h
>> +++ b/sysdeps/unix/sysv/linux/bits/sched.h
>> @@ -144,21 +144,21 @@ typedef struct
>>   # define __CPU_SET_S(cpu, setsize, cpusetp) \
>>     (__extension__                                                             \
>>      ({ size_t __cpu = (cpu);                                                  \
>> -      __cpu < 8 * (setsize)                                                  \
>> +      __cpu / 8 < (setsize)                                                  \
>>         ? (((__cpu_mask *) ((cpusetp)->__bits))[__CPUELT (__cpu)]                      \
>>           |= __CPUMASK (__cpu))                                                \
>>         : 0; }))
>>   # define __CPU_CLR_S(cpu, setsize, cpusetp) \
>>     (__extension__                                                             \
>>      ({ size_t __cpu = (cpu);                                                  \
>> -      __cpu < 8 * (setsize)                                                  \
>> +      __cpu /8 < (setsize)                                                   \
>
> Should be a space before the 8?


Yes, sure. Will fix in my commit once approved.

thanks,
Andreas
-- 
  Andreas Jaeger aj@{suse.com,opensuse.org} Twitter/Identica: jaegerandi
   SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
    GF: Jeff Hawn,Jennifer Guild,Felix Imendörffer,HRB16746 (AG Nürnberg)
     GPG fingerprint = 93A3 365E CE47 B889 DF7F  FED1 389A 563C C272 A126