[Bug 258559] tcsh can crash in morecore() due to 32-bit arithmetic

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=258559

            Bug ID: 258559
           Summary: tcsh can crash in morecore() due to 32-bit arithmetic
           Product: Base System
           Version: 13.0-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu

tcsh's allocator uses 32-bit ints in pointer arithmetic
in a way that's buggy on 64-bit machines: in morecore()
in tc.alloc.c, if bucket is >= 28, then these lines
aren't right:

    memtop = sbrk(1 << rnu);
    ...
    memtop += (long) (1 << rnu);
    ...
    siz = 1 << (bucket + 3);

The shifts yield 32-bit signed values, but the amounts of
shift can be big enough that the results wrap.

Here's a way to see the crash (it takes a few tens of seconds):

  % echo '$x:s<' | tcsh -f

-- 
You are receiving this mail because:
You are the assignee for the bug.