https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88890

            Bug ID: 88890
           Summary: libbacktrace on 32-bit system with _FILE_OFFSET_BITS
                    == 64
           Product: gcc
           Version: 9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libbacktrace
          Assignee: unassigned at gcc dot gnu.org
          Reporter: vries at gcc dot gnu.org
                CC: ian at gcc dot gnu.org
  Target Milestone: ---

In libbacktrace we use views to load portions of files into memory:
...
extern int backtrace_get_view (struct backtrace_state *state, int descriptor,
                               off_t offset, size_t size,
                               backtrace_error_callback error_callback,
                               void *data, struct backtrace_view *view);
...

One example using this function is:
...
  off_t min_offset;
  off_t max_offset;

  ...

  /* Read all the debug sections in a single view, since they are               
     probably adjacent in the file.  We never release this view.  */

  min_offset = 0;
  max_offset = 0;
  for (i = 0; i < (int) DEBUG_MAX; ++i)
    {
      off_t end;

      if (sections[i].size == 0)
        continue;
      if (min_offset == 0 || sections[i].offset < min_offset)
        min_offset = sections[i].offset;
      end = sections[i].offset + sections[i].size;
      if (end > max_offset)
        max_offset = end;
    }
  if (min_offset == 0 || max_offset == 0)
    {
      if (!backtrace_close (descriptor, error_callback, data))
        goto fail;
      return 1;
    }

  if (!backtrace_get_view (state, descriptor, min_offset,
                           max_offset - min_offset,
                           error_callback, data, &debug_view))
    goto fail;
  debug_view_valid = 1;
...

In the case of a 32-bit system with _FILE_OFFSET_BITS == 64, well have size_t
32-bit unsigned and off_t 64-bit signed, so the max_offset - min_offset
argument for the size parameter may be bigger than the size_t type of the size
parameter allows.

ISTM that the easiest way to fix this, is to change the type of the size
parameter to off_t, and to figure out in the implementation of
backtrace_get_view whether the value of size fits in size_t, and if not, return
with failure.

Reply via email to