Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IDIV DoS (INT_MIN / -1)

kqueue.org

Post reply on HN
Print view View original

11–20 of 24 posts

Re: IDIV DoS (INT_MIN / -1)

#11

Post by ThisIsADogHello »

huhsamovar wrote: post #9

I just tried the C version and it compiles and exits gracefully with gcc 4.2.1.

Similarly, I tried the pgsql example on 8.4.13, although on FreeBSD rather than Windows like they suggest, and all I got was: ERROR: floating-point exception DETAIL: An invalid floating-point operation was signaled. This probably means an out-of-range result or an invalid operation, such as division by zero.

Re: IDIV DoS (INT_MIN / -1)

#12

Post by haberman »

huhsamovar wrote: post #9

I just tried the C version and it compiles and exits gracefully with gcc 4.2.1.

That's probably because the code in the article uses compile-time constants as operands. Try this one and pass "-1" as the command-line parameter:

  int main(int argc, char *argv[]) { return (1LL
Note that this issue has been written about before by Tavis Ormandy: http://my.opera.com/taviso/blog/show.dml/639454

Re: IDIV DoS (INT_MIN / -1)

#13

Post by haberman »

kevinnk wrote: post #10
huhsamovar wrote: post #9

I just tried the C version and it compiles and exits gracefully with gcc 4.2.1.

The example the article gives isn't a general C problem, it's a common bug in some (mostly older) C/C++ compilers. As you point out GCC does not have this bug.

It's not a bug, it's intended to be undefined behavior; see http://www.open-std.org/jtc1/sc22/wg21/docs/cwg_defects.html... (issue 1450)

Re: IDIV DoS (INT_MIN / -1)

#14

Post by mikeash »

haberman wrote: post #13
kevinnk wrote: post #10

Earlier quoted context omitted.

The example the article gives isn't a general C problem, it's a common bug in some (mostly older) C/C++ compilers. As you point out GCC does not have this bug.

It's not a bug, it's intended to be undefined behavior; see http://www.open-std.org/jtc1/sc22/wg21/docs/cwg_defects.html... (issue 1450)

Regardless of undefined behavior, it should not crash the compiler.

Re: IDIV DoS (INT_MIN / -1)

#15

Post by haberman »

mikeash wrote: post #14
haberman wrote: post #13

Earlier quoted context omitted.

It's not a bug, it's intended to be undefined behavior; see http://www.open-std.org/jtc1/sc22/wg21/docs/cwg_defects.html... (issue 1450)

Regardless of undefined behavior, it should not crash the compiler.

Ah, I missed that it can crash the tcc compiler. Yeah, that's a bug.

Re: IDIV DoS (INT_MIN / -1)

#16

Post by derleth »

huhsamovar wrote: post #9

I just tried the C version and it compiles and exits gracefully with gcc 4.2.1.

Here's the LLVM code that clang-3.0-6ubuntu3 emits:

    define i64 @crash() nounwind uwtable readnone optsize {
      ret i64 undef
    }
In machine code terms, on x86-64 this turns into a function composed entirely of the ret opcode. gcc-4.6 adds an xor eax, eax before the ret.

Re: IDIV DoS (INT_MIN / -1)

#18

Post by huhsamovar »

haberman wrote: post #12
huhsamovar wrote: post #9

I just tried the C version and it compiles and exits gracefully with gcc 4.2.1.

That's probably because the code in the article uses compile-time constants as operands. Try this one and pass "-1" as the command-line parameter: int main(int argc, char *argv[]) { return (1LL Note that this issue has been written about before by Tavis Ormandy: http://my.opera.com/taviso/blog/show.dml/639454

Floating point exception: 8

Re: IDIV DoS (INT_MIN / -1)

#20

Post by loeg »

makomk wrote: post #6

If anyone here has used Second Life's scripting language LSL, they had to work around this issue. Apparently they now calculate x / -1 as -x instead, which gets a counter-intuitive result when x=INT_MIN but doesn't crash. I believe once upon a time this was documented and everything.

But -1*INT_MIN is still 1 greater than INT_MAX in two's complement ... so that's signed overflow and thus undefined behavior in C.

Assuming x86 signed overflow behavior, you're just back to INT_MIN again? Or am I crazy?

Post reply on HN