From: Jeff King <peff@peff.net>
To: "Ævar Arnfjörð Bjarmason" <avarab@gmail.com>
Cc: git@vger.kernel.org, Junio C Hamano <gitster@pobox.com>,
Johannes Schindelin <Johannes.Schindelin@gmx.de>,
Erik Faye-Lund <kusmabite@gmail.com>,
Jonathan Nieder <jrnieder@gmail.com>
Subject: Re: [RFC PATCH 10/10] linear-assignment.c: use "intmax_t" instead of "int"
Date: Thu, 9 Dec 2021 23:00:04 -0500 [thread overview]
Message-ID: <YbLQxId7DLkbT7mQ@coredump.intra.peff.net> (raw)
In-Reply-To: <RFC-patch-10.10-46395080b64-20211209T191653Z-avarab@gmail.com>
On Thu, Dec 09, 2021 at 08:19:27PM +0100, Ævar Arnfjörð Bjarmason wrote:
> Change the "int" type used by compute_assignment() to "intmax_t". On
> 64 bit systems this changes the overflow "die" added in the preceding
> commit (which before that was a segfault) to something that merely
> takes a very long time and a lot of memory to run.
>
> On my relatively beefy system this completes:
>
> git -P range-diff --creation-factor=50 origin/master...git-for-windows/main
>
> In around 300 seconds, with a reported max RSS of just under 18GB, but
> it does give you correct results for all ~50k commitsin that range.
So here you do what I think is the "real" fix. And at this point I
suspect that the overflow checks here:
> -static inline int cost_index(int *cost, int a, int b, int c)
> +static inline intmax_t cost_index(intmax_t *cost, intmax_t a, intmax_t b, intmax_t c)
> {
> - int r;
> + intmax_t r;
>
> if (INT_MULTIPLY_WRAPV(a, c, &r))
> - die(_("integer overflow in cost[%d + %d * %d] multiplication"), b, a, c);
> + die(_("integer overflow in cost[%"PRIuMAX" + %"PRIuMAX" * %"PRIuMAX"] multiplication"), b, a, c);
> if (INT_ADD_WRAPV(b, r, &r))
> - die(_("integer overflow in cost[%d + ((%d * %d) = %d)] addition"), b, a, c, r);
> + die(_("integer overflow in cost[%"PRIuMAX" + ((%"PRIuMAX" * %"PRIuMAX") = %"PRIuMAX")] addition"), b, a, c, r);
>
> return r;
cannot be triggered. We are indexing an array that is already limited to
size_t. So using that type should be sufficient (or else we have
problems even outside of overflow).
And for that reason I'd probably pick size_t (or ssize_t; you don't need
it in the hunk above, but presumably some of the other code cares about
signedness. And as I said earlier, it's effectively the same from a
protection standpoint).
-Peff
next prev parent reply other threads:[~2021-12-10 4:00 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-09 19:19 [RFC PATCH 00/10] range-diff: fix segfault due to integer overflow Ævar Arnfjörð Bjarmason
2021-12-09 19:19 ` [RFC PATCH 01/10] string-list API: change "nr" and "alloc" to "size_t" Ævar Arnfjörð Bjarmason
2021-12-09 19:19 ` [RFC PATCH 02/10] range-diff.c: don't use st_mult() for signed "int" Ævar Arnfjörð Bjarmason
2021-12-10 3:39 ` Jeff King
2021-12-10 10:22 ` Ævar Arnfjörð Bjarmason
2021-12-10 11:41 ` Jeff King
2021-12-10 12:31 ` Ævar Arnfjörð Bjarmason
2021-12-10 19:24 ` Phillip Wood
2021-12-14 14:34 ` Jeff King
2021-12-10 14:27 ` Johannes Schindelin
2021-12-10 14:58 ` Ævar Arnfjörð Bjarmason
2021-12-11 14:01 ` Johannes Schindelin
2021-12-12 17:44 ` Ævar Arnfjörð Bjarmason
2021-12-14 14:42 ` Jeff King
2021-12-09 19:19 ` [RFC PATCH 03/10] range-diff.c: use "size_t" to refer to "struct string_list"'s "nr" Ævar Arnfjörð Bjarmason
2021-12-09 19:19 ` [RFC PATCH 04/10] range-diff: zero out elements in "cost" first Ævar Arnfjörð Bjarmason
2021-12-09 19:19 ` [RFC PATCH 05/10] linear-assignment.c: split up compute_assignment() function Ævar Arnfjörð Bjarmason
2021-12-09 19:19 ` [RFC PATCH 06/10] linear-assignment.c: take "size_t", not "int" for *_count Ævar Arnfjörð Bjarmason
2021-12-09 19:19 ` [RFC PATCH 07/10] linear-assignment.c: convert a macro to a "static inline" function Ævar Arnfjörð Bjarmason
2021-12-09 19:19 ` [RFC PATCH 08/10] linear-assignment.c: detect signed add/mul on GCC and Clang Ævar Arnfjörð Bjarmason
2021-12-10 3:56 ` Jeff King
2021-12-09 19:19 ` [RFC PATCH 09/10] linear-assignment.c: add and use intprops.h from Gnulib Ævar Arnfjörð Bjarmason
2021-12-09 19:19 ` [RFC PATCH 10/10] linear-assignment.c: use "intmax_t" instead of "int" Ævar Arnfjörð Bjarmason
2021-12-10 4:00 ` Jeff King [this message]
2021-12-10 12:30 ` [RFC PATCH v2 0/5] range-diff: fix segfault due to integer overflow Ævar Arnfjörð Bjarmason
2021-12-10 12:30 ` [RFC PATCH v2 1/5] range-diff: zero out elements in "cost" first Ævar Arnfjörð Bjarmason
2021-12-14 13:36 ` Jeff King
2021-12-10 12:30 ` [RFC PATCH v2 2/5] linear-assignment.c: split up compute_assignment() function Ævar Arnfjörð Bjarmason
2021-12-14 13:39 ` Jeff King
2021-12-10 12:30 ` [RFC PATCH v2 3/5] linear-assignment.c: take "size_t", not "int" for *_count Ævar Arnfjörð Bjarmason
2021-12-14 13:40 ` Jeff King
2021-12-10 12:30 ` [RFC PATCH v2 4/5] range-diff.c: rename "n" to "column_count" in get_correspondences() Ævar Arnfjörð Bjarmason
2021-12-14 13:42 ` Jeff King
2021-12-10 12:30 ` [RFC PATCH v2 5/5] range-diff: fix integer overflow & segfault on cost[i + n * j] Ævar Arnfjörð Bjarmason
2021-12-14 14:04 ` Jeff King
2021-12-10 14:31 ` [RFC PATCH 00/10] range-diff: fix segfault due to integer overflow Johannes Schindelin
2021-12-10 15:07 ` Ævar Arnfjörð Bjarmason
2021-12-21 23:22 ` Philip Oakley
2021-12-21 23:36 ` Ævar Arnfjörð Bjarmason
2021-12-22 20:50 ` Johannes Schindelin
2021-12-22 21:11 ` Jeff King
2021-12-24 11:15 ` Philip Oakley
2021-12-24 16:46 ` Ævar Arnfjörð Bjarmason
2021-12-24 18:31 ` Philip Oakley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YbLQxId7DLkbT7mQ@coredump.intra.peff.net \
--to=peff@peff.net \
--cc=Johannes.Schindelin@gmx.de \
--cc=avarab@gmail.com \
--cc=git@vger.kernel.org \
--cc=gitster@pobox.com \
--cc=jrnieder@gmail.com \
--cc=kusmabite@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).