Fix signed integer overflow in random_r (bug 17343).

Bug 17343 reports that stdlib/random_r.c has code with undefined
behavior because of signed integer overflow on int32_t.  This patch
changes the code so that the possibly overflowing computations use
unsigned arithmetic instead.

Note that the bug report refers to "Most code" in that file.  The
places changed in this patch are the only ones I found where I think
such overflow can occur.

Tested for x86_64 and x86.

	[BZ #17343]
	* stdlib/random_r.c (__random_r): Use unsigned arithmetic for
	possibly overflowing computations.

(cherry picked from commit 8a07b0c43c46a480da070efd53a2720195e2256f)

diff --git a/ChangeLog b/ChangeLog
index 598e59de0eea5c4e86762ca73ec0fa64e57fcb0b..dbae1b9270388c7ee93d8786d38c72e4a5647047 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2018-03-20  Joseph Myers  <joseph@codesourcery.com>
+
+       [BZ #17343]
+       * stdlib/random_r.c (__random_r): Use unsigned arithmetic for
+       possibly overflowing computations.
+
 2018-03-03  Adhemerval Zanella  <adhemerval.zanella@linaro.org>
 
        [BZ #21269]

diff --git a/NEWS b/NEWS
index 106c7e0a7371e61179734fc7f717e7eaabcf98be..7c1526004fea966d0edf291f7e6f2842573f7de1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -74,6 +74,7 @@ Security related changes:
 The following bugs are resolved with this release:
 
   [16750] ldd: Never run file directly.
+  [17343] Fix signed integer overflow in random_r
   [17956] crypt: Use NSPR header files in addition to NSS header files
   [20532] getaddrinfo: More robust handling of dlopen failures
   [21242] assert: Suppress pedantic warning caused by statement expression

diff --git a/stdlib/random_r.c b/stdlib/random_r.c
index c3f6f9aede0ffc66bbbb99cbacd2dca7211d7d59..150fa9bb348d74fc72f7319317632b6e0e435d92 100644 (file)
--- a/stdlib/random_r.c
+++ b/stdlib/random_r.c
@@ -361,8 +361,7 @@ __random_r (struct random_data *buf, int32_t *result)
 
   if (buf->rand_type == TYPE_0)
     {
-      int32_t val = state[0];
-      val = ((state[0] * 1103515245) + 12345) & 0x7fffffff;
+      int32_t val = ((state[0] * 1103515245U) + 12345U) & 0x7fffffff;
       state[0] = val;
       *result = val;
     }
@@ -371,11 +370,11 @@ __random_r (struct random_data *buf, int32_t *result)
       int32_t *fptr = buf->fptr;
       int32_t *rptr = buf->rptr;
       int32_t *end_ptr = buf->end_ptr;
-      int32_t val;
+      uint32_t val;
 
-      val = *fptr += *rptr;
+      val = *fptr += (uint32_t) *rptr;
       /* Chucking least random bit.  */
-      *result = (val >> 1) & 0x7fffffff;
+      *result = val >> 1;
       ++fptr;
       if (fptr >= end_ptr)
        {