New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 651357 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
ex-Googler
Closed: Jan 2017
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Integer-overflow in computeJD

Project Member Reported by ClusterFuzz, Sep 29 2016

Issue description

Labels: findit-wrong Te-Logged
Owner: sh...@chromium.org
Status: Assigned (was: Untriaged)
Through code search on file "sqlite3.c", suspecting the below change
Review URL: https://codereview.chromium.org/2370463002

shess@ - Observed some recent changes on this file, so assigning to you. Could you please check if this is caused with respect to this change, if not please help us in reassign the issue to the right owner.

Comment 2 by sh...@chromium.org, Sep 29 2016

First, a cleaner minimization might be something like:
   SELECT TIME('now','+2666567 month');
which gives '-10952--391134--17' (compare to '2016-09-29')
The overflow is in computeJD (Julian Day) looks like:
  X1 = 36525*(Y+4716)/100;
I believe 36525 is 365.25*100 (the code is based on an astronomical reference).  There are other constants in here which would also be expected to have 32-bit overflow.

AFAICT, this code doesn't intend to handle overflow at all.  I believe the results would only be used as user data, not affecting SQLite's actual control flow, and since the code takes user data as input I also think it's unlikely to be inlined by a compiler in a way that could lead to brokenness.

Is there any way to get a sense of whether this is importantly-broken or something that should be suppressed?  The earlier CL involved a change which fixed a problem where overflow semantics were supposed to be well-defined.  In this case, I'm not sure there's any intention to guard against such invalid values.
Project Member

Comment 3 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by ClusterFuzz, Jan 27 2017

Status: WontFix (was: Assigned)
ClusterFuzz testcase 5631329305886720 is flaky and no longer reproduces, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment