helpThe GNU Bourne-Again SHell - Support: sr #107897, Divide by -1 can bring down bash...

 
 

sr #107897: Divide by -1 can bring down bash with SIGFPE

Submitted by:  None
Submitted on:  Wed 30 Nov 2011 09:48:01 PM UTC  
Votes:  50  
 
Category: NonePriority: 5 - Normal
Severity: 3 - NormalStatus: None
Privacy: PublicAssigned to: None
Originator Email: -unavailable-Open/Closed: Open
Operating System: None

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 29 Jan 2013 04:22:25 PM UTC, comment #1:

I made a patch to fix this issue (attached to this comment).
The changes occurs in expr.c in the function exp2(). When the divisor is -1, the function return either -dividend or 0 depending if the operation is a division or a modulo.

This was made on the git version :
~$ ./bash --version
GNU bash, version 4.2.42(3)-release (x86_64-unknown-linux-gnu)
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

~$ uname -a
Linux Archlinux 3.7.4-1-ARCH #1 SMP PREEMPT Mon Jan 21 23:05:29 CET 2013 x86_64 GNU/Linux

(file #27343)

Kevin Soules <eax64>
Wed 30 Nov 2011 09:48:01 PM UTC, original submission:

~ $ bash --version
GNU bash, version 4.2.10(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
~$ uname -a
Linux russ-laptop 3.2.0-2-generic #5-Ubuntu SMP Mon Nov 28 18:10:23 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux
~$ echo $(( 0x8000000000000000 / 0 ))
bash: 0x8000000000000000 / 0 : division by 0 (error token is "0 ")
~$ echo $(( 0x8000000000000000 / -1 ))
Floating point exception

(bash dies)

This floating point exception occurs because 0x8000000000000000 is -9223372036854775808, the most negative number on a 64 bit system. The largest positive number is 9223372036854775807. So by dividing by one an overflow occurs. (the excample may need to be modified for a 32bit system)

Expected behavior would be for bash to trap the exception as it does with divide by zero.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #27343:  diff.diff added by eax64 (352B - text/plain - Patch to prevent a floating point exception when dividing (2^63)-1 by -1)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by eax64 (Updated the item)
  • -unavailable- added by mestrelion (Voted in favor of this item)
  • -unavailable- added by None (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 50 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 29 Jan 2013 04:22:25 PM UTCeax64Attached File-=>Added diff.diff, #27343
    Mon 06 Feb 2012 05:15:54 PM UTCmestrelionCarbon-Copy-=>Added mestrelion

    Back to the top


    Powered by Savane 3.1-cleanup