Tcl Source Code: View Ticket

Ticket UUID:	0061c7a476f141128775d7982dc807f0ecf00d6a
Title:	signed integer overflow in ZipReadInt()
Type:	Patch	Version:	core-8-branch
Submitter:	chrstphrchvz	Created on:	2022-04-16 16:40:27
Subsystem:	37. File System	Assigned To:	jan.nijtmans
Priority:	5 Medium	Severity:	Minor
Status:	Closed	Last Modified:	2022-04-18 16:56:32
Resolution:	Fixed	Closed By:	jan.nijtmans
		Closed on:	2022-04-18 16:56:32
Description:	UBSan (`-fsanitize=shift-base`) error: tcl/generic/tclZipfs.c:470:55: runtime error: left shift of 252 by 24 places cannot be represented in type 'int' Avoid by casting to `unsigned int` before shifting: --- generic/tclZipfs.c.orig +++ generic/tclZipfs.c @@ -467,7 +467,8 @@ ZipReadInt( Tcl_Panic("out of bounds read(4): start=%p, end=%p, ptr=%p", bufferStart, bufferEnd, ptr); } - return ptr[0] \| (ptr[1] << 8) \| (ptr[2] << 16) \| (ptr[3] << 24); + return ptr[0] \| (ptr[1] << 8) \| (ptr[2] << 16) \| + ((unsigned int)ptr[3] << 24); } static inline unsigned short
User Comments:	jan.nijtmans added on 2022-04-18 16:56:32: Fixed [22b545403f\|here] Thanks for the report and the patch!