Division Bugs

Division Bugs

[Michael Zimmermann]

I think I found a bug but I'm not sure.

http://git.savannah.gnu.org/gitweb/?p=grub.git;a=blob;f=grub-core/lib/division.c;h=920a79f18b7a7180bc5bcf18987c043b1df56687;hb=refs/heads/master#l53
at line 53 u write a value to ro:
*ro = r;

now take a look at the callers:
http://git.savannah.gnu.org/gitweb/?p=grub.git;a=blob;f=grub-core/kern/compiler-rt.c;h=d4cc15513aabea3061bd2dddc896b105bb180a5b;hb=refs/heads/master

some look like this which should be ok:
grub_divmod64s (a, b, &ret);

but there are others like this:
grub_divmod64s (a, b, 0);

I got a "data abort, translation fault on write" exception after
compiling a lib which uses that division function.

Re: Division Bugs

[Andrei Borzenkov]

В Sat, 4 Apr 2015 22:49:28 +0200
Michael Zimmermann <sigmaepsilon92@gmail.com> пишет:

> I think I found a bug but I'm not sure.
> 
> http://git.savannah.gnu.org/gitweb/?p=grub.git;a=blob;f=grub-core/lib/division.c;h=920a79f18b7a7180bc5bcf18987c043b1df56687;hb=refs/heads/master#l53
> at line 53 u write a value to ro:
> *ro = r;
> 
> now take a look at the callers:
> http://git.savannah.gnu.org/gitweb/?p=grub.git;a=blob;f=grub-core/kern/compiler-rt.c;h=d4cc15513aabea3061bd2dddc896b105bb180a5b;hb=refs/heads/master
> 
> some look like this which should be ok:
> grub_divmod64s (a, b, &ret);
> 
> but there are others like this:
> grub_divmod64s (a, b, 0);
> 
> I got a "data abort, translation fault on write" exception after
> compiling a lib which uses that division function.
> 

Fixed. Unfortunately there does not appear any easy way to
regression test it. Dereferencing 0x0 pointer does not trigger an error,
unless you setup address mapping appropriately.

Thank you for report!