{"action":"created","issue":{"url":"https://api.github.com/repos/glennrp/libpng/issues/139","repository_url":"https://api.github.com/repos/glennrp/libpng","labels_url":"https://api.github.com/repos/glennrp/libpng/issues/139/labels{/name}","comments_url":"https://api.github.com/repos/glennrp/libpng/issues/139/comments","events_url":"https://api.github.com/repos/glennrp/libpng/issues/139/events","html_url":"https://github.com/glennrp/libpng/issues/139","id":180410644,"number":139,"title":"UBsan unsigned overflow reports [informational]","user":{"login":"jbowler","id":512616,"avatar_url":"https://avatars.githubusercontent.com/u/512616?v=3","gravatar_id":"","url":"https://api.github.com/users/jbowler","html_url":"https://github.com/jbowler","followers_url":"https://api.github.com/users/jbowler/followers","following_url":"https://api.github.com/users/jbowler/following{/other_user}","gists_url":"https://api.github.com/users/jbowler/gists{/gist_id}","starred_url":"https://api.github.com/users/jbowler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbowler/subscriptions","organizations_url":"https://api.github.com/users/jbowler/orgs","repos_url":"https://api.github.com/users/jbowler/repos","events_url":"https://api.github.com/users/jbowler/events{/privacy}","received_events_url":"https://api.github.com/users/jbowler/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-09-30T21:56:39Z","updated_at":"2016-10-01T01:57:43Z","closed_at":null,"body":"clang 3.8.1 with -fsanitize=unsigned-integer-overflow identifies the following 21 cases where overflow happens with libpng 1.6.26beta02.  This includes 10 cases in libpng itself which could be serious bugs if ISO-C did not define the behavior of unsigned overflow.   This is informational: ISO-C defines unsigned overflow completely and in the libpng cases there are two reasons:\r\n\r\n1) while (i-- > 0)\r\n   Where 'i' is unsigned is illegal in a language where unsigned overflow (underflow in this case) is not permitted.  There are six cases of things like this.\r\n\r\n2) Modular arithmetic: only one instance is detected by 'make check', but it probably happens in other cases as well.\r\n\r\nAs well as the list below the 107 separate reports are in a fill I will attach.\r\n\r\ncontrib/libtests/pngunknown.c:481:19: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'png_uint_32' (aka 'unsigned int')\r\ncontrib/libtests/pngvalid.c:11275:20: runtime error: unsigned integer overflow: 1008250423 * 8 cannot be represented in type 'unsigned int'\r\ncontrib/libtests/pngvalid.c:11276:20: runtime error: unsigned integer overflow: 1008250423 * 8 cannot be represented in type 'unsigned int'\r\ncontrib/libtests/pngvalid.c:11277:20: runtime error: unsigned integer overflow: 1008250423 * 8 cannot be represented in type 'unsigned int'\r\ncontrib/libtests/pngvalid.c:11278:20: runtime error: unsigned integer overflow: 1143599688 * 4 cannot be represented in type 'unsigned int'\r\ncontrib/libtests/pngvalid.c:11279:20: runtime error: unsigned integer overflow: 1143599688 * 4 cannot be represented in type 'unsigned int'\r\ncontrib/libtests/pngvalid.c:11294:20: runtime error: unsigned integer overflow: 1008250423 * 8 cannot be represented in type 'unsigned int'\r\ncontrib/libtests/pngvalid.c:11295:20: runtime error: unsigned integer overflow: 1008250423 * 8 cannot be represented in type 'unsigned int'\r\ncontrib/libtests/pngvalid.c:11296:20: runtime error: unsigned integer overflow: 1143599688 * 4 cannot be represented in type 'unsigned int'\r\ncontrib/libtests/pngvalid.c:11297:20: runtime error: unsigned integer overflow: 1143599688 * 4 cannot be represented in type 'unsigned int'\r\ncontrib/libtests/pngvalid.c:1245:18: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'png_uint_32' (aka 'unsigned int')\r\npngread.c:3234:18: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'png_uint_32' (aka 'unsigned int')\r\npngread.c:4067:18: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'png_uint_32' (aka 'unsigned int')\r\npngtrans.c:696:45: runtime error: unsigned integer overflow: 4294967288 * 128 cannot be represented in type 'unsigned int'\r\npngtrans.c:696:45: runtime error: unsigned integer overflow: 4294967288 * 256 cannot be represented in type 'unsigned int'\r\npngtrans.c:696:45: runtime error: unsigned integer overflow: 4294967288 * 2 cannot be represented in type 'unsigned int'\r\npngtrans.c:696:45: runtime error: unsigned integer overflow: 4294967288 * 32 cannot be represented in type 'unsigned int'\r\npngwrite.c:1557:12: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'png_uint_32' (aka 'unsigned int')\r\npngwrite.c:1708:15: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'png_uint_32' (aka 'unsigned int')\r\npngwrite.c:1749:15: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'png_uint_32' (aka 'unsigned int')\r\npngwrite.c:2139:15: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'png_uint_32' (aka 'unsigned int')\r\n"},"comment":{"url":"https://api.github.com/repos/glennrp/libpng/issues/comments/250885897","html_url":"https://github.com/glennrp/libpng/issues/139#issuecomment-250885897","issue_url":"https://api.github.com/repos/glennrp/libpng/issues/139","id":250885897,"user":{"login":"jbowler","id":512616,"avatar_url":"https://avatars.githubusercontent.com/u/512616?v=3","gravatar_id":"","url":"https://api.github.com/users/jbowler","html_url":"https://github.com/jbowler","followers_url":"https://api.github.com/users/jbowler/followers","following_url":"https://api.github.com/users/jbowler/following{/other_user}","gists_url":"https://api.github.com/users/jbowler/gists{/gist_id}","starred_url":"https://api.github.com/users/jbowler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbowler/subscriptions","organizations_url":"https://api.github.com/users/jbowler/orgs","repos_url":"https://api.github.com/users/jbowler/repos","events_url":"https://api.github.com/users/jbowler/events{/privacy}","received_events_url":"https://api.github.com/users/jbowler/received_events","type":"User","site_admin":false},"created_at":"2016-10-01T01:57:43Z","updated_at":"2016-10-01T01:57:43Z","body":"Conflict is on pngtrans.c because I added some macros on the assumption\nthat it was going to happen somewhere else as test coverage is changed.\n\nJohn\n\nOn Fri, Sep 30, 2016 at 6:55 PM, John Bowler <\njohn.cunningham.bowler@gmail.com> wrote:\n\n> Eh, they are all really to fix.  I've got a pull request pending but\n> running the 1000 builds that I normally run takes time.  Ok, I'll push it\n> to you.\n>\n> John\n>\n> On Fri, Sep 30, 2016 at 6:49 PM, Glenn Randers-Pehrson <\n> notifications@github.com> wrote:\n>\n>> These were all easy to fix except for the ones in pngvalid.c; something\n>> funny is going on there.\n>>\n>> Glenn\n>>\n>> On Fri, Sep 30, 2016 at 5:56 PM, John Bowler <notifications@github.com>\n>> wrote:\n>>\n>> > clang 3.8.1 with -fsanitize=unsigned-integer-overflow identifies the\n>> > following 21 cases where overflow happens with libpng 1.6.26beta02. This\n>> > includes 10 cases in libpng itself which could be serious bugs if ISO-C\n>> did\n>> > not define the behavior of unsigned overflow. This is informational:\n>> ISO-C\n>> > defines unsigned overflow completely and in the libpng cases there are\n>> two\n>> > reasons:\n>> >\n>> > 1) while (i-- > 0)\n>> > Where 'i' is unsigned is illegal in a language where unsigned overflow\n>> > (underflow in this case) is not permitted. There are six cases of things\n>> > like this.\n>> >\n>> > 2) Modular arithmetic: only one instance is detected by 'make check',\n>> but\n>> > it probably happens in other cases as well.\n>> >\n>> > As well as the list below the 107 separate reports are in a fill I will\n>> > attach.\n>> >\n>> > contrib/libtests/pngunknown.c:481:19: runtime error: unsigned integer\n>> > overflow: 0 - 1 cannot be represented in type 'png_uint_32' (aka\n>> 'unsigned\n>> > int')\n>> > contrib/libtests/pngvalid.c:11275:20: runtime error: unsigned integer\n>> > overflow: 1008250423 * 8 cannot be represented in type 'unsigned int'\n>> > contrib/libtests/pngvalid.c:11276:20: runtime error: unsigned integer\n>> > overflow: 1008250423 * 8 cannot be represented in type 'unsigned int'\n>> > contrib/libtests/pngvalid.c:11277:20: runtime error: unsigned integer\n>> > overflow: 1008250423 * 8 cannot be represented in type 'unsigned int'\n>> > contrib/libtests/pngvalid.c:11278:20: runtime error: unsigned integer\n>> > overflow: 1143599688 * 4 cannot be represented in type 'unsigned int'\n>> > contrib/libtests/pngvalid.c:11279:20: runtime error: unsigned integer\n>> > overflow: 1143599688 * 4 cannot be represented in type 'unsigned int'\n>> > contrib/libtests/pngvalid.c:11294:20: runtime error: unsigned integer\n>> > overflow: 1008250423 * 8 cannot be represented in type 'unsigned int'\n>> > contrib/libtests/pngvalid.c:11295:20: runtime error: unsigned integer\n>> > overflow: 1008250423 * 8 cannot be represented in type 'unsigned int'\n>> > contrib/libtests/pngvalid.c:11296:20: runtime error: unsigned integer\n>> > overflow: 1143599688 * 4 cannot be represented in type 'unsigned int'\n>> > contrib/libtests/pngvalid.c:11297:20: runtime error: unsigned integer\n>> > overflow: 1143599688 * 4 cannot be represented in type 'unsigned int'\n>> > contrib/libtests/pngvalid.c:1245:18: runtime error: unsigned integer\n>> > overflow: 0 - 1 cannot be represented in type 'png_uint_32' (aka\n>> 'unsigned\n>> > int')\n>> > pngread.c:3234:18: runtime error: unsigned integer overflow: 0 - 1\n>> cannot\n>> > be represented in type 'png_uint_32' (aka 'unsigned int')\n>> > pngread.c:4067:18: runtime error: unsigned integer overflow: 0 - 1\n>> cannot\n>> > be represented in type 'png_uint_32' (aka 'unsigned int')\n>> > pngtrans.c:696:45: runtime error: unsigned integer overflow: 4294967288\n>> *\n>> > 128 cannot be represented in type 'unsigned int'\n>> > pngtrans.c:696:45: runtime error: unsigned integer overflow: 4294967288\n>> *\n>> > 256 cannot be represented in type 'unsigned int'\n>> > pngtrans.c:696:45: runtime error: unsigned integer overflow: 4294967288\n>> *\n>> > 2 cannot be represented in type 'unsigned int'\n>> > pngtrans.c:696:45: runtime error: unsigned integer overflow: 4294967288\n>> *\n>> > 32 cannot be represented in type 'unsigned int'\n>> > pngwrite.c:1557:12: runtime error: unsigned integer overflow: 0 - 1\n>> cannot\n>> > be represented in type 'png_uint_32' (aka 'unsigned int')\n>> > pngwrite.c:1708:15: runtime error: unsigned integer overflow: 0 - 1\n>> cannot\n>> > be represented in type 'png_uint_32' (aka 'unsigned int')\n>> > pngwrite.c:1749:15: runtime error: unsigned integer overflow: 0 - 1\n>> cannot\n>> > be represented in type 'png_uint_32' (aka 'unsigned int')\n>> > pngwrite.c:2139:15: runtime error: unsigned integer overflow: 0 - 1\n>> cannot\n>> > be represented in type 'png_uint_32' (aka 'unsigned int')\n>> >\n>> > —\n>> > You are receiving this because you are subscribed to this thread.\n>> > Reply to this email directly, view it on GitHub\n>> > <https://github.com/glennrp/libpng/issues/139>, or mute the thread\n>> > <https://github.com/notifications/unsubscribe-auth/ABe25tUS3\n>> QVN8AImVD8fKR8s5Xwgm5Vpks5qvYWXgaJpZM4KLjDB>\n>> > .\n>> >\n>>\n>> —\n>> You are receiving this because you authored the thread.\n>> Reply to this email directly, view it on GitHub\n>> <https://github.com/glennrp/libpng/issues/139#issuecomment-250885521>,\n>> or mute the thread\n>> <https://github.com/notifications/unsubscribe-auth/AAfSaFG9eG18xcLrRBJ3Y51EDz6abPQMks5qvbwQgaJpZM4KLjDB>\n>> .\n>>\n>\n>\n>\n> --\n> John Bowler <john.cunningham.bowler@gmail.com>\n> +1 (541) 450-9885\n> PO BOX 3151\n> KERBY OR 97531-3151\n> USA\n>\n\n\n\n-- \nJohn Bowler <john.cunningham.bowler@gmail.com>\n+1 (541) 450-9885\nPO BOX 3151\nKERBY OR 97531-3151\nUSA\n"}}
{"actor":{"display_login":"jbowler"}}