2016-01-21 19:35:01

by J. Bruce Fields

[permalink] [raw]
Subject: Re: linux-4.4/net/sunrpc/auth_gss/gss_krb5_mech.c:296: Undefined Behaviour

On Sun, Jan 17, 2016 at 08:31:54PM +0000, David Binderman wrote:
> [linux-4.4/net/sunrpc/auth_gss/gss_krb5_mech.c:296]: (warning) Invalid test for overflow 'p+20<p'. Condition is always false unless there is overflow, and overflow is Undefined Behaviour.
>
> Source code is
>
>    if (unlikely(p + 20> end || p + 20 < p)) {

Looks like we make that assumption all over; e.g. see the checks in
xdr_reserve_space and __xdr_inline_decode. I guess that should be

if (unlikely(end - p < 20))

?

What's the practical effect right now? (E.g. does gcc actually violate
our assumption here currently?)

--b.