Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix undefined behavior in count_mmac_params #63

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

sorokin
Copy link

@sorokin sorokin commented Feb 26, 2023

When compiled -fsanitize=undefined nasm produced this error message:

asm/preproc.c:2523:25: runtime error: member access within null pointer of type 'struct Token'

The problem is reproducible on tests avx512f, avx512cd, avx512pf and avx512er in the test suite.

The problematic line was:

    /* Advance to the next comma */
    maybe_comma = &t->next;                            <<< HERE
    while (tok_isnt(t, ',')) {
        if (!tok_white(t))
            comma = NULL; /* Non-empty parameter */
        maybe_comma = &t->next;
        t = t->next;
    }

When t is NULL this line doesn't cause memory access, but it is still an undefined behavior according to C standard.

I believe that the underlying problem is that this loop doesn't have a sound invariant about maybe_comma:

  • On first iteration: *maybe_comma == t->next
  • On the following iterations: *maybe_comma == t

I don't know what the intended loop invariant is and I decided to just mechanically fix the deferencing of NULL pointer, completely preserving the existing behavior.

When compiled -fsanitize=undefined nasm produced this error message:

asm/preproc.c:2523:25: runtime error: member access within null pointer of type 'struct Token'

The problem is reproducible on tests avx512f, avx512cd, avx512pf
and avx512er in the test suite.

The problematic line was:

    /* Advance to the next comma */
    maybe_comma = &t->next;                            <<< HERE
    while (tok_isnt(t, ',')) {
        if (!tok_white(t))
            comma = NULL; /* Non-empty parameter */
        maybe_comma = &t->next;
        t = t->next;
    }

When t is NULL this line doesn't cause memory access, but it is still an
undefined behavior according to C standard.

I believe that the underlying problem is that this loop doesn't have a sound
invariant about maybe_comma:

* On first iteration: *maybe_comma == t->next
* On the following iterations: *maybe_comma == t

I don't know what the intended loop invariant is and I decided to just
mechanically fix the deferencing of NULL pointer, completely preserving
the existing behavior.

Signed-off-by: Ivan Sorokin <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant