From 1ea7255f8b0661cdfabbd13f8f443f81665a07e0 Mon Sep 17 00:00:00 2001 From: Paul Eggert Date: Sat, 3 Aug 2024 22:59:12 -0700 Subject: [PATCH] shuf: avoid integer overflow on huge inputs * gl/lib/randperm.c: Include . (randperm_bound): Return SIZE_MAX if the multiplication overflows. Do not overflow when converting bit count to byte count. Reference:https://github.com/coreutils/coreutils/commit/1ea7255f8b0661cdfabbd13f8f443f81665a07e0 Conflict:change gl/lib/randperm.c to lib/randperm.c; Adaptation to floor_lg() --- gl/lib/randperm.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/lib/randperm.c b/lib/randperm.c index 50328cd9a..14a304524 100644 --- a/lib/randperm.c +++ b/lib/randperm.c @@ -23,6 +23,7 @@ #include #include +#include #include #include "attribute.h" @@ -39,13 +40,15 @@ randperm_bound (size_t h, size_t n) { /* Upper bound on number of bits needed to generate the first number of the permutation. */ - uintmax_t lg_n = floor_lg (n) + 1; + unsigned int lg_n = floor_lg (n) + 1; - /* Upper bound on number of bits needed to generated the first H elements. */ - uintmax_t ar = lg_n * h; + /* Upper bound on number of bits needed to generate the first H elements. */ + uintmax_t ar; + if (ckd_mul (&ar, lg_n, h)) + return SIZE_MAX; /* Convert the bit count to a byte count. */ - size_t bound = (ar + CHAR_BIT - 1) / CHAR_BIT; + size_t bound = ar / CHAR_BIT + (ar % CHAR_BIT != 0); return bound; } -- 2.43.0