From: Jeff King <peff@peff•net>
To: Johannes Sixt <j6t@kdbg•org>
Cc: "René Scharfe" <l.s.r@web•de>, "Git List" <git@vger•kernel.org>,
"Junio C Hamano" <gitster@pobox•com>
Subject: Re: [PATCH] evaluate the second argument of ALLOC_GROW only once
Date: Mon, 18 May 2026 20:41:43 -0400 [thread overview]
Message-ID: <20260519004143.GA1612961@coredump.intra.peff.net> (raw)
In-Reply-To: <9ce768d4-0cbf-4494-a1d3-55fd3b05b61e@kdbg.org>
On Sat, May 16, 2026 at 08:55:54AM +0200, Johannes Sixt wrote:
> > Hmm, playing with it and looking a little closer, I think we don't end
> > up overflowing the buffer because you use the size_t for
> > REALLOC_ARRAY(). So the result is big, but then "alloc" is truncated.
>
> Protect against double-evaluation of "alloc", too, using
>
> size_t *palloc = &(alloc);
>
> and use *palloc in the two places, then all callers are forced to work
> with a size_t as third argument. Don't know what the damage would be,
> though.
I think it would be nice if all ALLOC_GROW() callers used a size_t, and
then we checked the size_t computation for overflow. But from a rough
guess (taking your suggestion and trying to compile) we'd need to adjust
~200 callers.
And it's not just a straight conversion:
1. Sometimes the ability to represent a negative value is important,
and each site has to be audited. If we could agree on a "as big as
size_t but signed" type, that might help.
2. Changing the alloc variable type without the matching "nr" can
actually make things worse. We tend to catch overflow-by-1 for
signed types incidentally because it results in a stupidly large
allocation request. But if made our allocations correct, then we
might overflow on "nr" and start writing to some huge negative
offset before the array.
So I think it would be a fair bit of work, though I would feel better
about the resulting state.
-Peff
prev parent reply other threads:[~2026-05-19 0:41 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-15 18:16 [PATCH] evaluate the second argument of ALLOC_GROW only once René Scharfe
2026-05-15 19:08 ` Jeff King
2026-05-15 19:50 ` Jeff King
2026-05-15 23:01 ` René Scharfe
2026-05-16 2:51 ` Jeff King
2026-05-16 11:10 ` René Scharfe
2026-05-16 6:55 ` Johannes Sixt
2026-05-19 0:41 ` Jeff King [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260519004143.GA1612961@coredump.intra.peff.net \
--to=peff@peff$(echo .)net \
--cc=git@vger$(echo .)kernel.org \
--cc=gitster@pobox$(echo .)com \
--cc=j6t@kdbg$(echo .)org \
--cc=l.s.r@web$(echo .)de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox