Tcl Source Code: View Ticket

2022-04-18
16:56		• Closed ticket [0061c7a476]: signed integer overflow in ZipReadInt() plus 7 o... artifact: 17db8ac299 user: jan.nijtmans
2022-04-16
19:03		Fix [0061c7a476]: signed integer overflow in ZipReadInt() check-in: 22b545403f user: jan.nijtmans tags: core-8-branch
16:41		• Ticket [0061c7a476] signed integer overflow in ZipReadInt() status still Ope... artifact: 16845da8d4 user: chrstphrchvz
16:40		• New ticket [0061c7a476]. artifact: 701f028ce7 user: chrstphrchvz

Ticket UUID:	0061c7a476f141128775d7982dc807f0ecf00d6a
Title:	signed integer overflow in ZipReadInt()
Type:	Patch	Created on:	2022-04-16 16:40:27
Submitter:	chrstphrchvz	Assigned to:	jan.nijtmans
Subsystem:	37. File System	Severity:	Minor
Priority:	5 Medium	Last modified:	2022-04-18 16:56:32
Status:	Closed	Closed by:	jan.nijtmans
Resolution:	Fixed	Closed on:	2022-04-18 16:56:32
Version:	core-8-branch

Description:
UBSan (`-fsanitize=shift-base`) error: tcl/generic/tclZipfs.c:470:55: runtime error: left shift of 252 by 24 places cannot be represented in type 'int' Avoid by casting to `unsigned int` before shifting: --- generic/tclZipfs.c.orig +++ generic/tclZipfs.c @@ -467,7 +467,8 @@ ZipReadInt( Tcl_Panic("out of bounds read(4): start=%p, end=%p, ptr=%p", bufferStart, bufferEnd, ptr); } - return ptr[0] \| (ptr[1] << 8) \| (ptr[2] << 16) \| (ptr[3] << 24); + return ptr[0] \| (ptr[1] << 8) \| (ptr[2] << 16) \| + ((unsigned int)ptr[3] << 24); } static inline unsigned short
User Comments:
jan.nijtmans added on 2022-04-18 16:56:32: Fixed [22b545403f\|here] Thanks for the report and the patch!