Tcl Source Code: View Ticket

Ticket UUID:	0061c7a476f141128775d7982dc807f0ecf00d6a
Title:	signed integer overflow in ZipReadInt()
Type:	Patch	Created on:	2022-04-16 16:40:27
Submitter:	chrstphrchvz	Assigned to:	jan.nijtmans
Subsystem:	37. File System	Severity:	Minor
Priority:	5 Medium	Last modified:	2022-04-18 16:56:32
Status:	Closed	Closed by:	jan.nijtmans
Resolution:	Fixed	Closed on:	2022-04-18 16:56:32
Version:	core-8-branch

Description:
UBSan (`-fsanitize=shift-base`) error: tcl/generic/tclZipfs.c:470:55: runtime error: left shift of 252 by 24 places cannot be represented in type 'int' Avoid by casting to `unsigned int` before shifting: --- generic/tclZipfs.c.orig +++ generic/tclZipfs.c @@ -467,7 +467,8 @@ ZipReadInt( Tcl_Panic("out of bounds read(4): start=%p, end=%p, ptr=%p", bufferStart, bufferEnd, ptr); } - return ptr[0] \| (ptr[1] << 8) \| (ptr[2] << 16) \| (ptr[3] << 24); + return ptr[0] \| (ptr[1] << 8) \| (ptr[2] << 16) \| + ((unsigned int)ptr[3] << 24); } static inline unsigned short
User Comments:
jan.nijtmans added on 2022-04-18 16:56:32: Fixed [22b545403f\|here] Thanks for the report and the patch!