oss-sec mailing list archives
possible flaw in widely used strtod.c implementation
From: Pierre Joye <pierre.php () gmail com>
Date: Wed, 5 Jan 2011 09:14:27 +0100
hi, Referring to: http://bugs.php.net/53632 This bug affects PHP and can be remotely triggered if someone actually process an input as double (p.php?id=... and then $d = $id +1 for example). However this issue could also affect any software relying on the "strtod for IEEE-, VAX-, and IBM-arithmetic machines." implementation (quite a lot actually do, according to codesearch&co). See a non exhaustive list here: http://www.google.com/codesearch?as_q=strtod+for+IEEE-,+VAX-,+and+IBM-arithmetic+machines.&btnG=Search+Code&hl=en&as_package=&as_lang=&as_filename=&as_class=&as_function=&as_license=&as_case= Whether the bug exists in the respective builds of each of these softwares may depend on how they are built (options, arch, etc.). A fix is already in php's svn: http://svn.php.net/viewvc?view=revision&revision=307095 A good explanation about this issue is in the gcc bug tracker (thanks Rasmus for the pointer): It is a design flaw in the x87 fpu registers, so keeping the float out of those registers circumvents the problem. It is one of the suggested ways of fixing this that is mentioned in the famous gcc bug 323 report: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=323 See Comment 87: bruno 2006-12-21 15:08:57 UTC The option -ffloat-store, recommended by Richard Henderson, has the effect of decreasing the performance of floating-point operations for the entire compilation unit. If you want a minimal fix that does not affect other functions in the same compilation unit, you can use 'volatile double' instead of 'double'. It's like a one-shot -ffloat-store. Example: #include <stdio.h> void test(double x, double y) { const volatile double y2 = x + 1.0; if (y != y2) printf("error\n"); } void main() { const double x = .012; const double y = x + 1.0; test(x, y); } On windows it is slightly more complicated as it seems to do some more under the wood work. I was able to reproduce the problem on certain CPUs (i7) and not on other (xeon) using the exact same binaries. I still have to verify what is done exactly. About getting a CVE #, I'm not sure it should be categorized only for php or more generally about this strtod.c (newest version has the same problem btw). Ideas? Comments? Cheers, -- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org
Current thread:
- possible flaw in widely used strtod.c implementation Pierre Joye (Jan 05)
- Re: possible flaw in widely used strtod.c implementation Michael Gilbert (Jan 05)
- Re: possible flaw in widely used strtod.c implementation Pierre Joye (Jan 05)
- Re: possible flaw in widely used strtod.c implementation Pierre Joye (Jan 06)
- Re: possible flaw in widely used strtod.c implementation Josh Bressers (Jan 06)
- Re: possible flaw in widely used strtod.c implementation Steven M. Christey (Jan 10)
- Re: possible flaw in widely used strtod.c implementation Pierre Joye (Feb 01)
- Re: possible flaw in widely used strtod.c implementation Pierre Joye (Jan 05)
- Re: possible flaw in widely used strtod.c implementation Michael Gilbert (Jan 05)