From patchwork Tue Sep 22 14:31:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 40473 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id AFFB13846035; Tue, 22 Sep 2020 14:32:20 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org AFFB13846035 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1600785140; bh=L6G5OAEn37ryvb8vF/3iLefTjGzJxqkSXqoJ7uct368=; h=To:Subject:Date:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:From; b=niDIvGWpHm7x3PW/lkTjEID26GqyagRElSxD/6HSsQK1kClmCr+31tkTGu+zJgVRA Y0+3Tq8ZH7qeml/LuyzpJwg+Pm/z+BvhFGHw8AZ3xSNCYMRUL4WT+PWDw8hi8VlSfP mQASssydf0n4/AH8iOYDbzke0tl6FJtMG1Uk2R4E= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81]) by sourceware.org (Postfix) with ESMTP id B56EA384C004 for ; Tue, 22 Sep 2020 14:31:56 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org B56EA384C004 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-363-s50R0FP8MlK8J--JMO0rhQ-1; Tue, 22 Sep 2020 10:31:49 -0400 X-MC-Unique: s50R0FP8MlK8J--JMO0rhQ-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 1551A1084D6B for ; Tue, 22 Sep 2020 14:31:48 +0000 (UTC) Received: from oldenburg2.str.redhat.com (ovpn-114-108.ams2.redhat.com [10.36.114.108]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 891DE5C1A3 for ; Tue, 22 Sep 2020 14:31:47 +0000 (UTC) To: libc-alpha@sourceware.org Subject: [PATCH] x86: Harden printf against non-normal long double values (bug 26649) Date: Tue, 22 Sep 2020 16:31:45 +0200 Message-ID: <87eemtyjam.fsf@oldenburg2.str.redhat.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-12.2 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, KAM_SHORT, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Florian Weimer via Libc-alpha From: Florian Weimer Reply-To: Florian Weimer Errors-To: libc-alpha-bounces@sourceware.org Sender: "Libc-alpha" The behavior of isnan/__builtin_isnan on bit patterns that do not correspond to something that the CPU would produce from valid inputs is currently under-defined in the toolchain. (The GCC built-in and glibc disagree.) The isnan check in PRINTF_FP_FETCH in stdio-common/printf_fp.c assumes the GCC behavior that returns true for non-normal numbers which are not specified as NaN. (The glibc implementation returns false for such numbers.) At present, passing non-normal numbers to __mpn_extract_long_double causes this function to produce irregularly shaped multi-precision integers, triggering undefined behavior in __printf_fp_l. With GCC 10 and glibc 2.32, this behavior is not visible because __builtin_isnan is used, which avoids calling __mpn_extract_long_double in this case. This commit updates the implementation of __mpn_extract_long_double so that regularly shaped multi-precision integers are produced in this case, avoiding undefined behavior in __printf_fp_l. --- sysdeps/i386/ldbl2mpn.c | 7 +++++ sysdeps/x86/Makefile | 4 +++ sysdeps/x86/tst-ldbl-nonnormal-printf.c | 52 +++++++++++++++++++++++++++++++++ 3 files changed, 63 insertions(+) diff --git a/sysdeps/i386/ldbl2mpn.c b/sysdeps/i386/ldbl2mpn.c index ec8464eef7..867c66ef8d 100644 --- a/sysdeps/i386/ldbl2mpn.c +++ b/sysdeps/i386/ldbl2mpn.c @@ -115,6 +115,13 @@ __mpn_extract_long_double (mp_ptr res_ptr, mp_size_t size, && res_ptr[N - 1] == 0) /* Pseudo zero. */ *expt = 0; + else + /* The sign bit is explicit, but add it in case it is missing in + the input. Otherwise, callers will not be able to produce the + expected multi-precision integer layout by shifting the sign + bit into the MSB. */ + res_ptr[N - 1] |= (mp_limb_t) 1 << (LDBL_MANT_DIG - 1 + - ((N - 1) * BITS_PER_MP_LIMB)); return N; } diff --git a/sysdeps/x86/Makefile b/sysdeps/x86/Makefile index c369faf00d..081cc72e93 100644 --- a/sysdeps/x86/Makefile +++ b/sysdeps/x86/Makefile @@ -11,6 +11,10 @@ tests += tst-get-cpu-features tst-get-cpu-features-static \ tests-static += tst-get-cpu-features-static endif +ifeq ($(subdir),math) +tests += tst-ldbl-nonnormal-printf +endif # $(subdir) == math + ifeq ($(subdir),setjmp) gen-as-const-headers += jmp_buf-ssp.sym sysdep_routines += __longjmp_cancel diff --git a/sysdeps/x86/tst-ldbl-nonnormal-printf.c b/sysdeps/x86/tst-ldbl-nonnormal-printf.c new file mode 100644 index 0000000000..72797fc33b --- /dev/null +++ b/sysdeps/x86/tst-ldbl-nonnormal-printf.c @@ -0,0 +1,52 @@ +/* Test printf with x86-specific non-normal long double value. + Copyright (C) 2020 Free Software Foundation, Inc. + + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include + +/* Fill the stack with non-zero values. This makes a crash in + snprintf more likely. */ +static void __attribute__ ((noinline, noclone)) +fill_stack (void) +{ + char buffer[65536]; + memset (buffer, 0xc0, sizeof (buffer)); + asm ("" ::: "memory"); +} + +static int +do_test (void) +{ + fill_stack (); + + long double value; + memcpy (&value, "\x00\x04\x00\x00\x00\x00\x00\x00\x00\x04", 10); + + char buf[30]; + int ret = snprintf (buf, sizeof (buf), "%Lg", value); + TEST_COMPARE (ret, strlen (buf)); + if (strcmp (buf, "nan") != 0) + /* If snprintf does not recognize the non-normal number as a NaN, + it has added the missing sign bit. */ + TEST_COMPARE_STRING (buf, "3.02201e-4624"); + return 0; +} + +#include