Signed integer overflow is undefined behavior in C, and recent compilers
(such as gcc and Clang) can optimize away checks that rely on signed
integer overflow (see simple example below).
OpenBSD contains a few such checks, which might be optimized away by a
compiler into no-ops, and which might be worth fixing. In particular:
http://es.csail.mit.edu/openbsd-kern-time.patch
http://es.csail.mit.edu/openbsd-uvm-mmap.patch
If the first check is optimized away, the pps counter might overflow; that
seems relatively unlikely. If the second check is optimized away, a user
process may be able to pass in very large values for pos/size that cause
problems later in mmap (I didn't try to construct a complete exploit, but
it may be worth fixing anyway).
Nickolai.
---
% cat t3.c
void foo(void);
void bar(int x) {
if (x + 100 < x)
foo();
}
% gcc t3.c -O2 -S -o -
.file "t3.c"
.text
.p2align 4,,15
.globl bar
.type bar, @function
bar:
.LFB0:
.cfi_startproc
rep
ret
.cfi_endproc
.LFE0:
.size bar, .-bar
.ident "GCC: (Ubuntu/Linaro 4.7.3-1ubuntu1) 4.7.3"
.section .note.GNU-stack,"",@progbits
%
