Bug 32957 - __builtin___memcpy_chk always overflow destination buffer
Summary: __builtin___memcpy_chk always overflow destination buffer
Status: CLOSED NOTABUG
Alias: None
Product: Sisyphus
Classification: Development
Component: glibc-devel (show other bugs)
Version: unstable
Hardware: all Linux
: P3 normal
Assignee: Gleb F-Malinovskiy
QA Contact: qa-sisyphus
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-12-30 14:39 MSK by Sergey V Turchin
Modified: 2016-12-30 15:02 MSK (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sergey V Turchin 2016-12-30 14:39:28 MSK 
glibc-devel-2.24-alt1
gcc5-c++-5.3.1-alt3

/usr/include/bits/string3.h:55:71: error: call to void* __builtin___memcpy_chk(void*, const void*, long unsigned int, long unsigned int) will always overflow destination buffer


In file included from /usr/include/string.h:648:0,
                 from /usr/include/qt5/QtCore/qarraydata.h:44,
                 from /usr/include/qt5/QtCore/qlist.h:46,
                 from /usr/include/qt5/QtCore/qqueue.h:43,
                 from /usr/include/qt5/QtCore/QQueue:1,
                 from qlowenergycontroller_p.h:73,
                 from qlowenergycontroller_bluez.cpp:42:
In function 'void* memcpy(void*, const void*, size_t)',
    inlined from 'void qToUnaligned(T, void*) [with T = short unsigned int]' at /usr/include/qt5/QtCore/qendian.h:82:5,
    inlined from 'void qToLittleEndian(T, void*) [with T = short unsigned int]' at /usr/include/qt5/QtCore/qendian.h:227:3,
    inlined from 'void putBtData(T, void*) [with T = short unsigned int]' at bluez/bluez_data_p.h:192:5,
    inlined from 'void QLowEnergyControllerPrivate::readServiceValuesByOffset(uint, quint16, bool)' at qlowenergycontroller_bluez.cpp:1510:34:


http://code.qt.io/cgit/qt/qtconnectivity.git/tree/src/bluetooth/qlowenergycontroller_bluez.cpp?h=v5.7.1

P.S.
Не могу собрать Qt-5.7.1 .
Comment 1 Dmitry V. Levin 2016-12-30 14:57:27 MSK 
Ну так там переполнение буфера, скажи спасибо, что тебе не дают это собрать.

void QLowEnergyControllerPrivate::readServiceValuesByOffset(
        uint handleData, quint16 offset, bool isLastValue)
...
quint8 packet[3];
...
putBtData(offset, &packet[3]);

т.е. ты пишешь quint16 по адресу последнего элемента массива quint8.
Comment 2 Sergey V Turchin 2016-12-30 15:02:12 MSK 
Спасибо! Теперь понятно.