bug-ncurses
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UBSAN errors in tinfo/read_entry.c's convert_32bits


From: Sam James
Subject: UBSAN errors in tinfo/read_entry.c's convert_32bits
Date: Fri, 6 Jan 2023 09:29:55 +0000

Hi,

When building ncurses 6.4 with UndefinedBehaviorSanitizer 
(-fsanitize=undefined),
I got the following when running `tput capname` (it happens during various real 
world
invocations of ncurses but this is the simplest);
```
$ export UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=0
$ tput capname
/var/tmp/portage/sys-libs/ncurses-6.4/work/ncurses-6.4/ncurses/tinfo/read_entry.c:92:24:
 runtime error: left shift of 255 by 24 places cannot be represented in type 
'int'
    #0 0x7f7f228c1e62 in convert_32bits 
/usr/src/debug/sys-libs/ncurses-6.4/ncurses-6.4/ncurses/tinfo/read_entry.c:92
    #1 0x7f7f228fe811 in _nc_read_termtype 
/usr/src/debug/sys-libs/ncurses-6.4/ncurses-6.4/ncurses/tinfo/read_entry.c:369
    #2 0x7f7f2290078a in _nc_read_file_entry 
/usr/src/debug/sys-libs/ncurses-6.4/ncurses-6.4/ncurses/tinfo/read_entry.c:576
    #3 0x7f7f22900b96 in _nc_read_tic_entry 
/usr/src/debug/sys-libs/ncurses-6.4/ncurses-6.4/ncurses/tinfo/read_entry.c:830
    #4 0x7f7f22901ba9 in _nc_read_entry2 
/usr/src/debug/sys-libs/ncurses-6.4/ncurses-6.4/ncurses/tinfo/read_entry.c:874
    #5 0x7f7f228dddc7 in _nc_setup_tinfo 
/usr/src/debug/sys-libs/ncurses-6.4/ncurses-6.4/ncurses/tinfo/lib_setup.c:496
    #6 0x7f7f228de9d0 in _nc_setupterm 
/usr/src/debug/sys-libs/ncurses-6.4/ncurses-6.4/ncurses/tinfo/lib_setup.c:779
    #7 0x561208b281a5 in main 
/usr/src/debug/sys-libs/ncurses-6.4/ncurses-6.4/progs/tput.c:398
    #8 0x7f7f220eb64f  (/usr/lib64/libc.so.6+0x2364f)
    #9 0x7f7f220eb708 in __libc_start_main (/usr/lib64/libc.so.6+0x23708)
    #10 0x561208b28a54 in _start (/usr/bin/tput+0x3a54)
```

This is on x86_64-pc-linux-gnu w/ GCC 12.2.1_p20221231.

It looks like it happens on processing 
/usr/share/terminfo/s/screen.xterm-256color? I've pasted
that file at http://sprunge.us/AEhXml.

A backtrace just before it happens again (if I set a breakpoint at 
read_entry.c:92) is:
```
[#0] 0x7ffff7f189b5 → convert_32bits(buf=0x7ffffffe2245 "", 
Numbers=0x55555557a1a0, count=0xf)
[#1] 0x7ffff7f1a812 → _nc_read_termtype(ptr=0x555555578580, 
buffer=0x7ffffffea290 "\036\002=", limit=0xe1f)
[#2] 0x7ffff7f1c78b → _nc_read_file_entry(filename=0x7fffffffa420 
"/usr/share/terminfo/s/screen.xterm-256color", ptr=0x555555578580)
[#3] 0x7ffff7f1cb97 → _nc_read_tic_entry(filename=0x7fffffffa420 
"/usr/share/terminfo/s/screen.xterm-256color", path=<optimized out>, 
name=0x5555555782b0 "screen.xterm-256color", tp=0x555555578580, limit=0x1000)
[#4] 0x7ffff7f1dbaa → _nc_read_entry2(name=<optimized out>, 
filename=0x7fffffffa420 "/usr/share/terminfo/s/screen.xterm-256color", 
tp=0x555555578580)
[#5] 0x7ffff7ef9dc8 → _nc_setup_tinfo(tn=<optimized out>, tp=0x555555578580)
[#6] 0x7ffff7efa9d1 → _nc_setupterm(tname=<optimized out>, Filedes=0x2, 
errret=0x7fffffffb508, reuse=0x0)
[#7] 0x7ffff7efbdeb → setupterm(tname=<optimized out>, Filedes=<optimized out>, 
errret=<optimized out>)
[#8] 0x5555555571a6 → main(argc=0x1, argv=0x7fffffffd6f0)
```

Let me know if more information is needed. Thanks.

Best,
sam

Attachment: signature.asc
Description: Message signed with OpenPGP


reply via email to

[Prev in Thread] Current Thread [Next in Thread]