Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix pointer wrap around undefined behavior #299

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

sasdf
Copy link

@sasdf sasdf commented Oct 17, 2024

movedelta(-1, 0);

zbar/zbar/img_scanner.c

Lines 861 to 866 in a549566

#define movedelta(dx, dy) \
do { \
x += (dx); \
y += (dy); \
p += (dx) + ((uintptr_t)(dy)*w); \
} while (0);

This expression movedelta(-1, 0); is expanded to

p += (-1) + ((uintptr_t)(0) * w);

where the RHS is evaluated unsigned as (uintptr_t) -1 i.e. 0xfff...

This pointer addition with unsigned wrap around is an undefined behavior in C.

In the latest clang trunk, the expr is optimized as a constant assignment ( p = -1; ), and segfault in runtime.
https://godbolt.org/z/G8xeMWTo5

This PR fixes the issue by casting the unsigned variable w to a signed type ptrdiff_t.
Given that dx and dy are both int, the RHS expression is evaluated as signed -1.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant