Download it now!
Bug 86543 - reinterpret_cast of 0xffffffff to pointer does not generate invalid pointer
Summary: reinterpret_cast of 0xffffffff to pointer does not generate invalid pointer
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
unspecified
Hardware: All All
: medium minor
Assignee: Stephan Bergmann
URL:
Whiteboard: target:4.5.0
Keywords:
Depends on:
Blocks:
 
Reported: 2014-11-21 22:56 UTC by Cesar Eduardo Barros
Modified: 2015-02-23 17:35 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Cesar Eduardo Barros 2014-11-21 22:56:00 UTC
I first noticed this at commit 26f2da07b1c6074e519d28557a3d1d5518ff6cb4.

There are a few places on the LibreOffice codebase where the maximum unsigned 32-bit value (0xffffffff) is cast to a pointer, to be used as some sort of flag value.

While this makes sense for 32-bit (it points to the last byte of the address space, where nothing of use can be found), on 64-bit it points to within usable address space, which might have been allocated by the platform.

What probably prevents this from causing any bug is that 0xffffffff is unaligned, and any sane allocator is going to return an aligned address, so that flag value cannot by accident match a valid object. But even then, it's sloppy.

The flag value should probably be changed to SIZE_MAX or similar, to make it the equivalent of reinterpret_cast<...>(-1) even on 64-bit.

Here are the places I have found:

$ git grep -i -P 'reinterpret_cast.*0xffffffff' master
master:basic/source/runtime/ddectrl.cxx:#define DDE_FREECHANNEL (reinterpret_cast<DdeConnection*>(0xffffffff))
master:include/svtools/grfmgr.hxx:#define GRFMGR_AUTOSWAPSTREAM_NONE      (reinterpret_cast<SvStream*>(0xffffffffUL))
master:include/vcl/dialog.hxx:#define DIALOG_NO_PARENT (reinterpret_cast<vcl::Window*>(0xffffffff))
master:sw/source/core/frmedt/fedesc.cxx:    const SwPageDesc* pFnd, *pRetDesc = reinterpret_cast<SwPageDesc*>(0xffffffff);
master:sw/source/core/frmedt/fedesc.cxx:        if( reinterpret_cast<SwPageDesc*>(0xffffffff) == pRetDesc )

The last one should also use a #define instead of magic numbers.
Comment 1 Julien Nabet 2014-11-23 21:58:41 UTC
Noel: thought you might be interested in this one (see http://cgit.freedesktop.org/libreoffice/core/commit/?id=26f2da07b1c6074e519d28557a3d1d5518ff6cb4)
Comment 2 Robinson Tryon (qubit) 2014-12-22 03:17:18 UTC
(In reply to Cesar Eduardo Barros from comment #0)
> on 64-bit it points to within
> usable address space, which might have been allocated by the platform.
> 
> What probably prevents this from causing any bug is that 0xffffffff is
> unaligned, and any sane allocator is going to return an aligned address, so
> that flag value cannot by accident match a valid object. But even then, it's
> sloppy.

Sounds like a reasonable concern, so I'll change Status -> NEW.
Comment 3 Stephan Bergmann 2015-02-23 17:35:28 UTC
thanks for noticing

<http://cgit.freedesktop.org/libreoffice/core/commit/?id=3b513aefa49ecc98800ff129360f04bda8405a11> "tdf#86543: reinterpret_cast -1 of appropriate width as special marker"