Fix signed integer overflow in random_r (bug 17343).

Bug 17343 reports that stdlib/random_r.c has code with undefined
behavior because of signed integer overflow on int32_t.  This patch
changes the code so that the possibly overflowing computations use
unsigned arithmetic instead.

Note that the bug report refers to "Most code" in that file.  The
places changed in this patch are the only ones I found where I think
such overflow can occur.

Tested for x86_64 and x86.

	[BZ #17343]
	* stdlib/random_r.c (__random_r): Use unsigned arithmetic for
	possibly overflowing computations.

diff --git a/ChangeLog b/ChangeLog
index 3399e567b82bf920be0dd39ce4b77752d3ef6d36..83fa3089e5e269abee298f285da232d193245778 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2018-03-20  Joseph Myers  <joseph@codesourcery.com>
+
+       [BZ #17343]
+       * stdlib/random_r.c (__random_r): Use unsigned arithmetic for
+       possibly overflowing computations.
+
 2018-03-20  Samuel Thibault  <samuel.thibault@ens-lyon.org>
 
        * manual/errno.texi (EOWNERDEAD, ENOTRECOVERABLE): Remove errno

diff --git a/stdlib/random_r.c b/stdlib/random_r.c
index 4d2f0d472f3246b4c62b078c2db18ca6588635bd..b47c65c6d723bd852f439885c1ec56a2c559323c 100644 (file)
--- a/stdlib/random_r.c
+++ b/stdlib/random_r.c
@@ -361,8 +361,7 @@ __random_r (struct random_data *buf, int32_t *result)
 
   if (buf->rand_type == TYPE_0)
     {
-      int32_t val = state[0];
-      val = ((state[0] * 1103515245) + 12345) & 0x7fffffff;
+      int32_t val = ((state[0] * 1103515245U) + 12345U) & 0x7fffffff;
       state[0] = val;
       *result = val;
     }
@@ -371,11 +370,11 @@ __random_r (struct random_data *buf, int32_t *result)
       int32_t *fptr = buf->fptr;
       int32_t *rptr = buf->rptr;
       int32_t *end_ptr = buf->end_ptr;
-      int32_t val;
+      uint32_t val;
 
-      val = *fptr += *rptr;
+      val = *fptr += (uint32_t) *rptr;
       /* Chucking least random bit.  */
-      *result = (val >> 1) & 0x7fffffff;
+      *result = val >> 1;
       ++fptr;
       if (fptr >= end_ptr)
        {