Mercurial > hg
changeset 38303:1fb2510cf8c8
bitmanipulation: fix undefined behavior in bit shift in getbe32
OSS-Fuzz caught this in its ubsan mode[0]. I'm not worried about a
security issue here because in practice this should work out the way
we naively expected, we're just making things explicit to the
compiler with the casts.
0: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8876
Differential Revision: https://phab.mercurial-scm.org/D3729
| author | Augie Fackler <augie@google.com> |
|---|---|
| date | Wed, 13 Jun 2018 10:24:44 -0400 |
| parents | 74b4a54002ec |
| children | fabfbbf4dee2 |
| files | contrib/fuzz/mpatch_corpus.py mercurial/bitmanipulation.h |
| diffstat | 2 files changed, 6 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/contrib/fuzz/mpatch_corpus.py Wed Jun 13 21:58:42 2018 +0900 +++ b/contrib/fuzz/mpatch_corpus.py Wed Jun 13 10:24:44 2018 -0400 @@ -78,6 +78,10 @@ zf.writestr( "mpatch_decode_old_overread", "\x02\x00\x00\x00\x02\x00\x00\x00" ) + # https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8876 + zf.writestr( + "mpatch_ossfuzz_getbe32_ubsan", + "\x02\x00\x00\x00\x0c \xff\xff\xff\xff ") zf.writestr( "mpatch_apply_over_memcpy", '\x13\x01\x00\x05\xd0\x00\x00\x00\x00\x00\x00\x00\x00\n \x00\x00\x00'
--- a/mercurial/bitmanipulation.h Wed Jun 13 21:58:42 2018 +0900 +++ b/mercurial/bitmanipulation.h Wed Jun 13 10:24:44 2018 -0400 @@ -9,7 +9,8 @@ { const unsigned char *d = (const unsigned char *)c; - return ((d[0] << 24) | (d[1] << 16) | (d[2] << 8) | (d[3])); + return ((((uint32_t)d[0]) << 24) | (((uint32_t)d[1]) << 16) | + (((uint32_t)d[2]) << 8) | (d[3])); } static inline int16_t getbeint16(const char *c)