From: Paul Eggert Date: Thu, 12 Jun 2025 07:20:52 +0000 (-0700) Subject: Port short_read to UBSan X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7d96e820a52531097db23f38725e178a9f7d66b0;p=thirdparty%2Ftar.git Port short_read to UBSan Problem reported by Kirill Furman in: https://lists.gnu.org/r/bug-tar/2025-06/msg00002.html * src/buffer.c (short_read): Use (char *) record_start, instead of record_start->buffer, to avoid undefined behavior accessing past end of buffer. In practice the undefined behavior is harmless unless running with -fsanitize=undefined or a similarly-picky implementation. --- diff --git a/THANKS b/THANKS index 21ae387e..20afca38 100644 --- a/THANKS +++ b/THANKS @@ -308,6 +308,7 @@ Kevin D Quitt drs@netcom.com Kevin Dalley kevin@aimnet.com Kimball Collins kpc@ptolemy.arc.nasa.gov Kimmy Posey kimmyd@bnr.ca +Kirill Furman kfurman@astralinux.ru Koji Kishi kis@rqa.sony.co.jp Konno Hiroharu konno@pac.co.jp Kurt Jaeger pi@lf.net diff --git a/src/buffer.c b/src/buffer.c index 1cdeffc6..2c40e948 100644 --- a/src/buffer.c +++ b/src/buffer.c @@ -959,11 +959,8 @@ archive_is_dev (void) static void short_read (idx_t status) { - idx_t left; /* bytes left */ - char *more; /* pointer to next byte to read */ - - more = record_start->buffer + status; - left = record_size - status; + idx_t left = record_size - status; /* bytes left to read */ + char *more = (char *) record_start + status; /* address of next read */ if (left && left % BLOCKSIZE == 0 && (warning_option & WARN_RECORD_SIZE)