[v3] sprof: check pread size and offset for overflow
Andreas Schwab
schwab@suse.de
Wed Oct 22 08:10:17 GMT 2025
In file included from sprof.c:25:
sprof.c: In function ‘load_shobj’:
sprof.c:573:16: error: format ‘%zd’ expects argument of type ‘signed size_t’, but argument 5 has type ‘off_t’ {aka ‘long long int’} [-Werror=format=]
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../include/libintl.h:48:55: note: in definition of macro ‘_’
48 | # define _(msgid) __dcgettext (_libc_intl_domainname, msgid, LC_MESSAGES)
| ^~~~~
sprof.c:580:3: note: in expansion of macro ‘PCHECK’
580 | PCHECK (size, ehdr->e_shoff);
| ^~~~~~
sprof.c:573:54: note: format string is defined here
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ~~^
| |
| int
| %lld
sprof.c:573:16: error: format ‘%zu’ expects argument of type ‘size_t’, but argument 6 has type ‘__off64_t’ {aka ‘long long int’} [-Werror=format=]
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../include/libintl.h:48:55: note: in definition of macro ‘_’
48 | # define _(msgid) __dcgettext (_libc_intl_domainname, msgid, LC_MESSAGES)
| ^~~~~
sprof.c:580:3: note: in expansion of macro ‘PCHECK’
580 | PCHECK (size, ehdr->e_shoff);
| ^~~~~~
sprof.c:573:60: note: format string is defined here
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ~~^
| |
| unsigned int
| %llu
sprof.c:573:16: error: format ‘%zd’ expects argument of type ‘signed size_t’, but argument 5 has type ‘off_t’ {aka ‘long long int’} [-Werror=format=]
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../include/libintl.h:48:55: note: in definition of macro ‘_’
48 | # define _(msgid) __dcgettext (_libc_intl_domainname, msgid, LC_MESSAGES)
| ^~~~~
sprof.c:586:3: note: in expansion of macro ‘PCHECK’
586 | PCHECK (shdr[ehdr->e_shstrndx].sh_size,
| ^~~~~~
sprof.c:573:54: note: format string is defined here
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ~~^
| |
| int
| %lld
sprof.c:573:16: error: format ‘%zu’ expects argument of type ‘size_t’, but argument 6 has type ‘__off64_t’ {aka ‘long long int’} [-Werror=format=]
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../include/libintl.h:48:55: note: in definition of macro ‘_’
48 | # define _(msgid) __dcgettext (_libc_intl_domainname, msgid, LC_MESSAGES)
| ^~~~~
sprof.c:586:3: note: in expansion of macro ‘PCHECK’
586 | PCHECK (shdr[ehdr->e_shstrndx].sh_size,
| ^~~~~~
sprof.c:573:60: note: format string is defined here
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ~~^
| |
| unsigned int
| %llu
sprof.c:573:16: error: format ‘%zd’ expects argument of type ‘signed size_t’, but argument 5 has type ‘off_t’ {aka ‘long long int’} [-Werror=format=]
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../include/libintl.h:48:55: note: in definition of macro ‘_’
48 | # define _(msgid) __dcgettext (_libc_intl_domainname, msgid, LC_MESSAGES)
| ^~~~~
sprof.c:615:7: note: in expansion of macro ‘PCHECK’
615 | PCHECK (size, debuglink_entry->sh_offset);
| ^~~~~~
sprof.c:573:54: note: format string is defined here
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ~~^
| |
| int
| %lld
sprof.c:573:16: error: format ‘%zu’ expects argument of type ‘size_t’, but argument 6 has type ‘__off64_t’ {aka ‘long long int’} [-Werror=format=]
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../include/libintl.h:48:55: note: in definition of macro ‘_’
48 | # define _(msgid) __dcgettext (_libc_intl_domainname, msgid, LC_MESSAGES)
| ^~~~~
sprof.c:615:7: note: in expansion of macro ‘PCHECK’
615 | PCHECK (size, debuglink_entry->sh_offset);
| ^~~~~~
sprof.c:573:60: note: format string is defined here
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ~~^
| |
| unsigned int
| %llu
sprof.c:573:16: error: format ‘%zd’ expects argument of type ‘signed size_t’, but argument 5 has type ‘off_t’ {aka ‘long long int’} [-Werror=format=]
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../include/libintl.h:48:55: note: in definition of macro ‘_’
48 | # define _(msgid) __dcgettext (_libc_intl_domainname, msgid, LC_MESSAGES)
| ^~~~~
sprof.c:675:11: note: in expansion of macro ‘PCHECK’
675 | PCHECK (sizeof (ehdr2), 0);
| ^~~~~~
sprof.c:573:54: note: format string is defined here
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ~~^
| |
| int
| %lld
sprof.c:573:16: error: format ‘%zu’ expects argument of type ‘size_t’, but argument 6 has type ‘__off64_t’ {aka ‘long long int’} [-Werror=format=]
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../include/libintl.h:48:55: note: in definition of macro ‘_’
48 | # define _(msgid) __dcgettext (_libc_intl_domainname, msgid, LC_MESSAGES)
| ^~~~~
sprof.c:675:11: note: in expansion of macro ‘PCHECK’
675 | PCHECK (sizeof (ehdr2), 0);
| ^~~~~~
sprof.c:573:60: note: format string is defined here
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ~~^
| |
| unsigned int
| %llu
sprof.c:573:16: error: format ‘%zd’ expects argument of type ‘signed size_t’, but argument 5 has type ‘off_t’ {aka ‘long long int’} [-Werror=format=]
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../include/libintl.h:48:55: note: in definition of macro ‘_’
48 | # define _(msgid) __dcgettext (_libc_intl_domainname, msgid, LC_MESSAGES)
| ^~~~~
sprof.c:686:11: note: in expansion of macro ‘PCHECK’
686 | PCHECK (size, ehdr2.e_shoff);
| ^~~~~~
sprof.c:573:54: note: format string is defined here
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ~~^
| |
| int
| %lld
sprof.c:573:16: error: format ‘%zu’ expects argument of type ‘size_t’, but argument 6 has type ‘__off64_t’ {aka ‘long long int’} [-Werror=format=]
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../include/libintl.h:48:55: note: in definition of macro ‘_’
48 | # define _(msgid) __dcgettext (_libc_intl_domainname, msgid, LC_MESSAGES)
| ^~~~~
sprof.c:686:11: note: in expansion of macro ‘PCHECK’
686 | PCHECK (size, ehdr2.e_shoff);
| ^~~~~~
sprof.c:573:60: note: format string is defined here
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ~~^
| |
| unsigned int
| %llu
sprof.c:573:16: error: format ‘%zd’ expects argument of type ‘signed size_t’, but argument 5 has type ‘off_t’ {aka ‘long long int’} [-Werror=format=]
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../include/libintl.h:48:55: note: in definition of macro ‘_’
48 | # define _(msgid) __dcgettext (_libc_intl_domainname, msgid, LC_MESSAGES)
| ^~~~~
sprof.c:693:11: note: in expansion of macro ‘PCHECK’
693 | PCHECK (shdr2[ehdr2.e_shstrndx].sh_size,
| ^~~~~~
sprof.c:573:54: note: format string is defined here
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ~~^
| |
| int
| %lld
sprof.c:573:16: error: format ‘%zu’ expects argument of type ‘size_t’, but argument 6 has type ‘__off64_t’ {aka ‘long long int’} [-Werror=format=]
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../include/libintl.h:48:55: note: in definition of macro ‘_’
48 | # define _(msgid) __dcgettext (_libc_intl_domainname, msgid, LC_MESSAGES)
| ^~~~~
sprof.c:693:11: note: in expansion of macro ‘PCHECK’
693 | PCHECK (shdr2[ehdr2.e_shstrndx].sh_size,
| ^~~~~~
sprof.c:573:60: note: format string is defined here
573 | _("read outside of file extents %zu + %zd > %zu"), \
| ~~^
| |
| unsigned int
| %llu
cc1: all warnings being treated as errors
make[2]: *** [../o-iterator.mk:9: /home/abuild/rpmbuild/BUILD/glibc-2.42.9000.340.geb35513d3-build/glibc-2.42.9000.340.geb35513d3/cc-base/elf/sprof.o] Error 1
--
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."
More information about the Libc-alpha
mailing list