mainThe GNU Bourne-Again SHell - Support: sr #107897, Divide by -1 can bring down bash...

 
 

sr #107897: Divide by -1 can bring down bash with SIGFPE

Submitter:  None
Submitted:  Wed 30 Nov 2011 09:48:01 PM UTC
Votes: 50
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  None
Originator Email:  -email is unavailable- Open/Closed:  Open
Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 29 Jan 2013 04:22:25 PM UTC, comment #1: 

I made a patch to fix this issue (attached to this comment).
The changes occurs in expr.c in the function exp2(). When the divisor is -1, the function return either -dividend or 0  depending if the operation is a division or a modulo.


This was made on the git version :
~$ ./bash --version
GNU bash, version 4.2.42(3)-release (x86_64-unknown-linux-gnu)
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.


~$ uname -a
Linux Archlinux 3.7.4-1-ARCH #1 SMP PREEMPT Mon Jan 21 23:05:29 CET 2013 x86_64 GNU/Linux

(file #27343)

 Kevin Soules <eax64>
Wed 30 Nov 2011 09:48:01 PM UTC, original submission:  

~ $ bash --version
GNU bash, version 4.2.10(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
~$ uname -a
Linux russ-laptop 3.2.0-2-generic #5-Ubuntu SMP Mon Nov 28 18:10:23 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux
~$ echo $(( 0x8000000000000000 / 0 ))
bash: 0x8000000000000000 / 0 : division by 0 (error token is "0 ")
~$ echo $(( 0x8000000000000000 / -1 ))
Floating point exception

(bash dies)

This floating point exception occurs because 0x8000000000000000 is -9223372036854775808, the most negative number on a 64 bit system. The largest positive number is 9223372036854775807. So by dividing by one an overflow occurs. (the excample may need to be modified for a 32bit system)

Expected behavior would be for bash to trap the exception as it does with divide by zero.

 Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #27343:  diff.diff added by eax64 (352B - text/plain - Patch to prevent a floating point exception when dividing (2^63)-1 by -1)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by chet (Updated the item)
  • -email is unavailable- added by eax64 (Updated the item)
  • -email is unavailable- added by mestrelion (Voted in favor of this item)
  • -email is unavailable- added by None (Submitted the item)

    •  

    There are 50 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-11-12 chet StatusNone Done
    2013-01-29 eax64 Attached File- Added diff.diff, #27343
    2012-02-06 mestrelion Carbon-Copy- Added mestrelion

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-f13d.
    Corresponding source code