Skip to content

Undefined behavior around calls to generic functions like OPENSSL_LH_HASHFUNC #22896

@jwalch

Description

@jwalch

We started seeing a complaint from LLVM17 sanitizer via some application nominally using OpenSSL:

crypto/lhash/lhash.c:299:12: runtime error: call to function err_string_data_hash through pointer to incorrect function type 'unsigned long (*)(const void *)'
[...]/crypto/err/err.c:184: note: err_string_data_hash defined here
    #0 0x7fa569e3a434 in getrn [...]/crypto/lhash/lhash.c:299:12
    #1 0x7fa569e39a46 in OPENSSL_LH_insert [...]/crypto/lhash/lhash.c:119:10
    #2 0x7fa569d866ee in err_load_strings [...]/crypto/err/err.c:280:15
[...]

Strangely there were not other reports, despite the fact that obviously this idiom is used for various LHASH and in STACK also.

Unsurprisingly this seems to be impacting many other C-based projects whose authors are not especially thrilled either:

systemd/systemd#29972
python/cpython#111178
php/php-src@ca22505

There seems also to even be some conversation in the original LLVM thread on whether or not this is truly UB: https://reviews.llvm.org/D148827

Metadata

Metadata

Assignees

No one assigned

    Labels

    branch: 3.0Applies to openssl-3.0 branchbranch: 3.1Applies to openssl-3.1 (EOL)branch: 3.2Applies to openssl-3.2 (EOL)branch: 3.3Applies to openssl-3.3branch: 3.4Applies to openssl-3.4branch: masterApplies to master branchtriaged: bugThe issue/pr is/fixes a bug

    Type

    No type

    Projects

    Status

    Pre-Refinement

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions