sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-08 21:18:16 +03:00
Code

util:tsort.h: add a macro for safely comparing numbers

Browse Source 
In many places we use `return a - b;` in a comparison function. This can
be problematic if the comparison is used in a sort, as `a - b` is not
guaranteed to do what we expect. For example:

* if a and b are 2s-complement ints, a is INT_MIN and b is INT_MAX, then
  a - b = 1, which is wrong.

* if a and b are 64 bit pointers, a - b could wrap around many times in
  a cmp function returning 32 bit ints. (We do this often).

The issue is not just that a sort could go haywire.
Due to a bug in glibc, this could result in out-of-bounds access:

https://www.openwall.com/lists/oss-security/2024/01/30/7

(We have replicated this bug in ldb_qsort).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15625

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 5ab93f48c5)
This commit is contained in:
Douglas Bagnall 2024-04-03 12:43:27 +13:00 committed by Jule Anger
parent 3a840553cf
commit b46af17050
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
lib/util/tsort.h
View File

@ -37,4 +37,23 @@ do { \
} while (0)
#endif
#ifndef NUMERIC_CMP
/*
* NUMERIC_CMP is a safe replacement for `a - b` in comparison
* functions. It will work on integers, pointers, and floats.
*
* Rather than
*
* return a - b;
*
* use
*
* return NUMERIC_CMP(a, b);
*
* and you won't have any troubles if a - b would overflow.
*/
#define NUMERIC_CMP(a, b) (((a) > (b)) - ((a) < (b)))
#endif
#endif