Bug 258559 - tcsh can crash in morecore() due to 32-bit arithmetic
Summary: tcsh can crash in morecore() due to 32-bit arithmetic
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 13.0-RELEASE
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-09-17 14:21 UTC by Robert Morris
Modified: 2021-10-04 20:15 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Morris 2021-09-17 14:21:04 UTC
tcsh's allocator uses 32-bit ints in pointer arithmetic
in a way that's buggy on 64-bit machines: in morecore()
in tc.alloc.c, if bucket is >= 28, then these lines
aren't right:

    memtop = sbrk(1 << rnu);
    ...
    memtop += (long) (1 << rnu);
    ...
    siz = 1 << (bucket + 3);

The shifts yield 32-bit signed values, but the amounts of
shift can be big enough that the results wrap.

Here's a way to see the crash (it takes a few tens of seconds):

  % echo '$x:s<' | tcsh -f