Tcl Source Code

int size overflowing when incremented is undefined behavior. Example script and output showing UBSan (-fsanitize=signed-integer-overflow) error:

set f [open /dev/zero [list RDONLY BINARY]]
fconfigure $f -buffersize [expr {2**20}]
set z [read $f [expr {2**30}]]
puts [::tcl::mathop::ni $z [list]]

tcl/generic/tclBinary.c:568:10: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
max size for a Tcl value (2147483647 bytes) exceeded

(tclsh aborted)

If size does not overflow, it could instead be INT_MAX, causing overflow in ckalloc(size + 1). Example script and output:

set f [open /dev/zero [list RDONLY BINARY]]
fconfigure $f -buffersize [expr {2**20}]
set a [encoding convertto utf-8 a]
set z [read $f [expr {2**30 - 1}]]
set az [string cat $a $z]
puts [::tcl::mathop::ni $az [list]]

tcl/generic/tclBinary.c:575:19: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
1

Casting size to unsigned int avoids this; see attached patch. (There could be alternatives such as declaring size as unsigned int.)

@dgp, I like your alternative! Just go ahead.

Alternative patch to consider found on bug-9c7557160f branch.

Leaves behind fewer typecasts for future code readers to puzzle over.

Fixed [5e793d379a|here]. Thanks!