This is a live mirror of the Perl 5 development currently hosted at https://github.com/perl/perl5
avoid integer overflow in Perl_av_extend_guts()
authorDavid Mitchell <davem@iabyn.com>
Sun, 21 Dec 2014 00:40:13 +0000 (00:40 +0000)
committerDavid Mitchell <davem@iabyn.com>
Wed, 31 Dec 2014 11:28:51 +0000 (11:28 +0000)
commit2afa5dd07629c20c6931b8c5e4c1671520787a9d
tree4a00c51cd429f82d4cee295c264406698a83175c
parentcbb52ffe38ad57101631b748bc04127568f728e2
avoid integer overflow in Perl_av_extend_guts()

There were two issues; first the 'overextend' algorithm (add a fifth of
the current size to the requested size) could overflow,
and secondly MEM_WRAP_CHECK_1() was being called with newmax+1,
which could overflow if newmax happened to equal SSize_t_MAX.

e.g.

    $a[0x7fffffffffffffff] = 1
    $a[5] = 1; $a[0x7fffffffffffffff] = 1

could produce under ASan:

    av.c:133:16: runtime error: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long'
    av.c:170:7: runtime error: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long'
av.c