[debbugs-tracker] bug#14917: closed (Missing range check in fxcopy-bit can give SIGABRT)

[GNU bug Tracking System]

Your message dated Tue, 21 Jun 2016 09:35:44 +0200
with message-id <address@hidden>
and subject line Re: bug#14917: Missing range check in fxcopy-bit can give 
SIGABRT
has caused the debbugs.gnu.org bug report #14917,
regarding Missing range check in fxcopy-bit can give SIGABRT
to be marked as done.

(If you believe you have received this mail in error, please contact
address@hidden)


-- 
14917: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=14917
GNU Bug Tracking System
Contact address@hidden with problems

--- Begin Message --- Subject: Missing range check in fxcopy-bit can give SIGABRT Date: Sat, 20 Jul 2013 08:57:29 +0200 User-agent: Gnus/5.13 (Gnus v5.13) Emacs/23.4 (gnu/linux)

Hello schemers,

the fxcopy-bit procedure from (rnrs) is missing some range checks. It
can return a non-fixnum:

scheme@(guile-user)> (import (rnrs))
scheme@(guile-user)> (fxcopy-bit 0 (fixnum-width) 1)
$1 = 9223372036854775808

It can also crash the guile process, which is somewhat surprising for a
fixnum procedure:

scheme@(guile-user)> (import (rnrs))
scheme@(guile-user)> (fxcopy-bit 0 100000000000 0)
FATAL: memory error in realloc
Aborted

Here's an alternative error message:

scheme@(guile-user)> (import (rnrs))
scheme@(guile-user)> (fxcopy-bit 0 1000000000000 0)
gmp: overflow in mpz type
Aborted

Other implementations of fxcopy-bit usually check that the third
argument is 0 or 1, but I'm not sure that is required.

There's also a bitwise-copy-bit procedure that is similary affected.
Tested with Guile 2.0.9.40-824b-dirty on an amd64 system.

Regards,

-- 
Göran Weinholt <address@hidden>
"Mr. Crane, please remember you're not required to answer any of
Lt. Tragg's questions. As a matter of fact, don't even discuss the
weather with him, he can be very persuasive." -- Perry Mason

pgp2L7fTQml0v.pgp
Description: PGP signature

--- End Message ---

> --- Begin Message ---
>
>
>
> Subject: 
>
> Re: bug#14917: Missing range check in fxcopy-bit can give SIGABRT
>
>
>
>
> Date: 
>
> Tue, 21 Jun 2016 09:35:44 +0200
>
>
>
>
> User-agent: 
>
> Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)
>
>
>
>
> Howdy :)
>
> Three years later, this is now fixed and will be in 2.1.4.  I think
> we'll cherry-pick it back to 2.0.12 too.
>
> Cheers,
>
> Andy
>
> On Sat 20 Jul 2013 08:57, Göran Weinholt <address@hidden> writes:
>
> > Hello schemers,
> >
> > the fxcopy-bit procedure from (rnrs) is missing some range checks. It
> > can return a non-fixnum:
> >
> > scheme@(guile-user)> (import (rnrs))
> > scheme@(guile-user)> (fxcopy-bit 0 (fixnum-width) 1)
> > $1 = 9223372036854775808
> >
> > It can also crash the guile process, which is somewhat surprising for a
> > fixnum procedure:
> >
> > scheme@(guile-user)> (import (rnrs))
> > scheme@(guile-user)> (fxcopy-bit 0 100000000000 0)
> > FATAL: memory error in realloc
> > Aborted
> >
> > Here's an alternative error message:
> >
> > scheme@(guile-user)> (import (rnrs))
> > scheme@(guile-user)> (fxcopy-bit 0 1000000000000 0)
> > gmp: overflow in mpz type
> > Aborted
> >
> > Other implementations of fxcopy-bit usually check that the third
> > argument is 0 or 1, but I'm not sure that is required.
> >
> > There's also a bitwise-copy-bit procedure that is similary affected.
> > Tested with Guile 2.0.9.40-824b-dirty on an amd64 system.
> >
> > Regards,
>
>
> --- End Message ---