Bug 204945 - usr.sbin/acpi/acpidump/acpi.c:729: code relies on undefined behaviour ?
Summary: usr.sbin/acpi/acpidump/acpi.c:729: code relies on undefined behaviour ?
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-acpi (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-12-01 19:40 UTC by David Binderman
Modified: 2025-02-26 05:28 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description David Binderman 2015-12-01 19:40:44 UTC 
[usr/src/usr.sbin/acpi/acpidump/acpi.c:729]: (warning) Invalid test for overflow 'vaddr+sizeof(struct TCPAevent)<vaddr'. Condition is always false unless there is overflow, and overflow is Undefined Behaviour.

Source code is

        if ((vaddr + sizeof(struct TCPAevent) >= vend)||
            (vaddr + sizeof(struct TCPAevent) < vaddr))
            break;
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2025-02-26 02:53:08 UTC 
^Triage: to submitter: is this aging PR still valid?
Comment 2 Konstantin Belousov freebsd_committer freebsd_triage 2025-02-26 04:18:30 UTC 
In fact, yes, it is the valid report.
Comment 3 commit-hook freebsd_committer freebsd_triage 2025-02-26 05:28:37 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=8c108dccd7f878ad44aaef1f5bfb5622666bd09a

commit 8c108dccd7f878ad44aaef1f5bfb5622666bd09a
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2025-02-26 05:24:30 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2025-02-26 05:27:32 +0000

    acpidump: do not use pointer arithmetic to check for overflow

    Pointer arithmetic overflow is UB.  Convert to unsigned uintptr_t and do
    the check there.

    PR:     204945
    Reported by:    David Binderman <dcb314@hotmail.com>
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week

 usr.sbin/acpi/acpidump/acpi.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)