Tcl Source Code

Example scripts and corresponding output with UBSan (-fsanitize=signed-integer-overflow) errors:

1. set f [open /dev/zero [list RDONLY BINARY]]
   fconfigure $f -buffersize [expr {2**20}]
   set z [read $f [expr {2**30}]]
   proc as2 {s} {return [string cat [encoding convertto utf-8 a] $s $s]}
   set az2 [as2 $z]
   

   tcl/generic/tclExecute.c:2770:17: runtime error: signed integer overflow: 1073741824 + 1073741824 cannot be represented in type 'int'
   max size for a Tcl value (2147483647 bytes) exceeded
   

   (tclsh aborted)

2. set a [string repeat [string repeat a [expr {2**10}]] [expr {2**20}]]
   proc us2 {s} {return [string cat {u} $s $s]}
   set ua2 [us2 $a]
   

   tcl/generic/tclExecute.c:2778:17: runtime error: signed integer overflow: 1073741824 + 1073741824 cannot be represented in type 'int'
   max size for a Tcl value (2147483647 bytes) exceeded
   

   (tclsh aborted)

3. set a [string repeat [string repeat a 1023] 1049601]
   proc uus2 {s} {return [string cat {uu} $s $s]}
   set uua2 [uus2 $a]
   

   tcl/generic/tclExecute.c:2812:17: runtime error: signed integer overflow: 2 + 2147483646 cannot be represented in type 'int'
   max size for a Tcl value (2147483647 bytes) exceeded
   

   (tclsh aborted)

4. set a [string repeat [string repeat a 1023] 1049601]
   proc zs2 {s} {return [string cat [expr 0] $s $s]}
   set za2 [zs2 $a]
   

   tcl/generic/tclExecute.c:2820:25: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
   

   (tclsh exited normally)

5. set a [string repeat [string repeat a 1023] 1049601]
   proc us2 {s} {return [string cat {u} $s $s]}
   set ua2 [us2 $a]
   

   tcl/generic/tclExecute.c:2827:7: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
   

   (tclsh exited normally)

6. set f [open /dev/zero [list RDONLY BINARY]]
   fconfigure $f -buffersize [expr {2**20}]
   set z [read $f [expr {2**30}]]
   proc s2 {s} {return [string cat $s $s]}
   set z2 [s2 $z]
   

   tcl/generic/tclExecute.c:2848:17: runtime error: signed integer overflow: 1073741824 + 1073741824 cannot be represented in type 'int'
   max size for a Tcl value (2147483647 bytes) exceeded
   

   (tclsh aborted)

The attached patch prevents these.