bugGNU Octave - Bugs: bug #56862, [octave forge] (interval) UB in...

 
 

bug #56862: [octave forge] (interval) UB in crlibm found by cppcheck

Submitter:  None
Submitted:  Fri 06 Sep 2019 07:27:09 AM UTC
   
 
Category:  Octave Package Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  None Assigned to:  None
Originator Name:  Originator Email:  -email is unavailable-
Open/Closed:  * Open Release:  * other
Operating System:  * Any Fixed Release:  None
Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 01 Feb 2021 09:02:23 PM UTC, comment #1: 

As you have noticed, the upstream of libcrm is no longer maintained.  Thus, the library has been bundled into the interval package.

Eventually, libcrm will be replaced by its successor MetaLibm-Lugdunum [2] in the future, once that reaches a stable release.

In the meantime the errors should probably be fixed in the interval repository.  [uninitvar] and [arrayIndexThenCheck] seem to be easy to fix and there are not too many of them.

The warnings about “Shifting a negative value” require more knowledge about what is actually going on in the code.

[2] https://github.com/kalray/metalibm

Anonymous
Fri 06 Sep 2019 07:27:09 AM UTC, original submission:  

libcrm as found in octave-interval 3.2.0 has various unitialized variables, out-of-bounds dereference, and other issues. These were found by cppcheck, a linter and static analysis tool for C and C++.

However, upstream [1] doesn't have a bugtracker, and the last bugfix is from 2011, so is this the right place to report?

src/crlibm/log1p.c:424:7: error: Uninitialized variable: E [uninitvar]
src/crlibm/log1p.c:712:7: error: Uninitialized variable: E [uninitvar]
src/crlibm/log1p.c:999:7: error: Uninitialized variable: E [uninitvar]
src/crlibm/log1p.c:1286:7: error: Uninitialized variable: E [uninitvar]
E is only initialized in "else" branches.

src/crlibm/scs_lib/addition_scs.c:108:19: style: Array index 'k' is used before limits check. [arrayIndexThenCheck]
src/crlibm/scs_lib/addition_scs.c:493:18: style: Array index 'i' is used before limits check. [arrayIndexThenCheck]
src/crlibm/scs_lib/addition_scs.c:542:16: style: Array index 'i' is used before limits check. [arrayIndexThenCheck]
Dereferencing an array past the last item is undefined behavior.

There are other warnings, e.g. "Shifting a negative value is technically undefined behaviour", but I didn't check them.

[1]: https://gforge.inria.fr/scm/browser.php?group_id=5929&extra=crlibm

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by siko1056 (Package maintainer)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-02-07 siko1056 Carbon-Copy- Added oheim

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code