Package: erlang
Version: 1:17.0-dfsg-3
Usertags: goto-cc

During a rebuild of all packages in a clean sid chroot (and cowbuilder+pbuilder)
the build failed with the following error. Please note that we use our research
compiler tool-chain (using tools from the cbmc package), which permits extended
reporting on type inconsistencies at link time.

[...]
 LD 
/srv/jenkins-slave/workspace/sid-goto-cc-erlang/erlang-17.0-dfsg/bin/x86_64-pc-linux-gnu/beam.smp

error: conflicting function declarations "erts_gzinflate_buffer"
old definition in module beam_load file beam/beam_load.c line 46
struct erl_drv_binary * (char *, signed int)
new definition in module gzio file drivers/common/gzio.c line 752
struct erl_drv_binary * (char *start, unsigned long int size)


Reviewing the code at

http://sources.debian.net/src/erlang/1:17.0-dfsg-3/erts/emulator/beam/beam_load.c#L46
http://sources.debian.net/src/erlang/1:17.0-dfsg-3/erts/emulator/drivers/common/gzio.c#L751

this appears particularly dangerous as the implementation of
erts_gzinflate_buffer may read arbitrary memory beyond the desired allocation,
because the high bytes of "size" will be uninitialised on systems with
sizeof(long)!=sizeof(int).

The maintainer may wish to adjust severity.

Best,
Michael

Attachment: pgpKFx1UzmyZB.pgp
Description: PGP signature

Reply via email to