319 Star 2.1K Fork 1K

OpenHarmony / kernel_liteos_a

 / 详情

kernal_liteos_a/lib/libc/musl/src/string/strstr.c 代码中存在操作数值未定义的问题

已拒绝
缺陷
创建于  
2021-01-20 01:32

该问题是怎么引起的?

kernal_liteos_a/lib/libc/musl/src/string/strstr.c中
line 110: k = l-shift[h[l-1]];
The operand has undefined value. l - shift[h[l - 1]];
存在执行路径使得 ,l=0 ,即shift[h[l-1]为不合法操作数;

重现步骤

1、kernal_liteos_a/lib/libc/musl/src/string/strstr.c
line 33:static char *twoway_strstr(const unsigned char *h, const unsigned char *n)
Start Analysis;

2、kernal_liteos_a/lib/libc/musl/src/string/strstr.c
line 41:for (l=0; n[l] && h[l]; l++)
if ( n[l]==0 || h[l]==0 ) Then Take the false branch;

3、kernal_liteos_a/lib/libc/musl/src/string/strstr.c
line 43:if (n[l]) return 0;
n[l]==0 Then Take the false branch;

4、kernal_liteos_a/lib/libc/musl/src/string/strstr.c
line 47:while (jp+k<l) {
jp = 0; k = p = 1; l=0 ;jp + k > l; Take the false branch;

5、kernal_liteos_a/lib/libc/musl/src/string/strstr.c
line 67:while (jp+k<l) {
jp = 0; k = p = 1; l=0 ;jp + k > l; Take the false branch;

6、kernal_liteos_a/lib/libc/musl/src/string/strstr.c
line 82:if (ip+1 > ms+1) ms = ip;
ip = -1;ms = ip;ip + 1 = ms + 1 Take the false branch;

7、kernal_liteos_a/lib/libc/musl/src/string/strstr.c
line 86:if (memcmp(n, n+p, ms+1)) {
Call a function. memcmp(n, n + p, ms + 1);

8、kernal_liteos_a/lib/libc/musl/src/string/strstr.c
line 86:if (memcmp(n, n+p, ms+1)) {
Take the true branch. memcmp(n, n + p, ms + 1);

9、kernal_liteos_a/lib/libc/musl/src/string/strstr.c
line 88:p = MAX(ms, l-ms-1) + 1;
Take the false branch. (ms) < (l - ms - 1);

10、kernal_liteos_a/lib/libc/musl/src/string/strstr.c
line 98:if (z-h < l) {
z = h; z-h = l; Take the false branch;

11、kernal_liteos_a/lib/libc/musl/src/string/strstr.c
line 109:if (BITOP(byteset, h[l-1], &)) {
(byteset)[(size_t)(h[l - 1]) / (8 * sizeof (byteset))] & (size_t)1 << ((size_t)(h[l - 1]) % (8 * sizeof (byteset)));
** Take the true branch. ;

12、kernal_liteos_a/lib/libc/musl/src/string/strstr.c
line 110:k = l-shift[h[l-1]];
l = 0 ; The operand has undefined value. l - shift[h[l - 1]]

报错信息

kernal_liteos_a/lib/libc/musl/src/string/strstr.c中
line 110: k = l-shift[h[l-1]];
The operand has undefined value. l - shift[h[l - 1]];
存在执行路径使得 ,l=0 ,即shift[h[l-1]为不合法操作数;

评论 (1)

star-os-bugs 创建了任务
star-os-bugs 修改了描述
star-os-bugs 任务类型任务 修改为缺陷
Denny 负责人设置为Caoruihong
Caoruihong 任务状态待办的 修改为已确认
展开全部操作日志

经分析该问题为误报。

首先,strstr在入口已经校验字符串n长度不为0 :
https://gitee.com/openharmony/third_party_musl/blob/a6919e3f97196587fe623f0cfe0d834857a83628/kernel/src/string/strstr.c#L141

其次,twoway_strstr在入口也校验了字符串h长度不小于n长度,因此l不会为0。
https://gitee.com/openharmony/third_party_musl/blob/a6919e3f97196587fe623f0cfe0d834857a83628/kernel/src/string/strstr.c#L43

最后, twoway_strstr为static方法,仅被本文件中的strstr函数调用,综上,此问题为误报。

Caoruihong 任务状态已确认 修改为已拒绝

登录 后才可以发表评论

状态
负责人
项目
里程碑
Pull Requests
关联的 Pull Requests 被合并后可能会关闭此 issue
分支
开始日期   -   截止日期
-
置顶选项
优先级
预计工期 (小时)
参与者(2)
7989137 caoruihong 1601432415
C
1
https://gitee.com/openharmony/kernel_liteos_a.git
git@gitee.com:openharmony/kernel_liteos_a.git
openharmony
kernel_liteos_a
kernel_liteos_a

搜索帮助