bug; false positive "negative-size-param" in wcsnrtombs for size=SIZE_MAX
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
# AddressSanitizer throws false positive "negative-size-param" in wcsnrtombs for size=SIZE_MAX
## Description
AddressSanitizer (ASAN) interceptor for `wcsnrtombs` throws a `negative-size-param: (size=-1)` error when the `nwc` argument (the max number of wide characters to convert) is passed as `SIZE_MAX` (or `(size_t)-1`).
According to POSIX / C standard, `size_t` is an unsigned integer, and passing `SIZE_MAX` is a standard way to indicate "unlimited" or "no maximum" bounds (effectively relying on the null-terminator for the end of the string). ASAN incorrectly interprets this as a signed `-1` and aborts the program.
## Reproducer
```c
// run with: gcc -fsanitize=address -xc -
#include
#include
int main() {
mbstate_t state = {0};
const wchar_t *psrc = L"";
return wcsnrtombs(0, &psrc, SIZE_MAX, 0, &state);
}
```
## Output
```
=================================================================
==39137==ERROR: AddressSanitizer: negative-size-param: (size=-1)
#0 0x72ea788d409f in wcsnrtombs.part.0 (/lib/libasan.so.8+0xd409f)
#1 0x6331776fd28c in main test_asan_wcsnrtombs.c:9
#2 0x72ea7842a4d7 in __libc_start_call_main (/lib/libc.so.6+0x2a4d7)
#3 0x72ea7842a59a in __libc_start_main@@GLIBC_2.34 (/lib/libc.so.6+0x2a59a)
#4 0x6331776fd0d4 in _start
SUMMARY: AddressSanitizer: negative-size-param test_asan_wcsnrtombs.c:9 in main
==39137==ABORTING
```
or:
```
=================================================================
==3511584==ERROR: AddressSanitizer: negative-size-param: (size=-1)
#0 0x710d310d409f in wcsnrtombs.part.0 (/nix/store/ghh8n7bbj5lsi6xbk3driyvsdxw6vfz9-gcc-15.2.0-lib/lib/libasan.so.8+0xd409f)
#1 0x5db98769f28c in main (/home/kamil/myprojects/yio/_tmp/a.out+0x128c)
#2 0x710d30c2a4d7 in __libc_start_call_main (/nix/store/pdwlyjkmc6icc0wb5gaw08m9ynqrg683-glibc-2.40-218/lib/libc.so.6+0x2a4d7) (BuildId: 91170f193417cebdbe0490588b65bdeb6a88502c)
#3 0x710d30c2a59a in __libc_start_main@@GLIBC_2.34 (/nix/store/pdwlyjkmc6icc0wb5gaw08m9ynqrg683-glibc-2.40-218/lib/libc.so.6+0x2a59a) (BuildId: 91170f193417cebdbe0490588b65bdeb6a88502c)
#4 0x5db98769f0d4 in _start (/home/kamil/myprojects/yio/_tmp/a.out+0x10d4)
0x5db9876a0040 is located 0 bytes inside of global variable '*.LC1' defined in '' (0x5db9876a0040) of size 4
SUMMARY: AddressSanitizer: negative-size-param (/home/kamil/myprojects/yio/_tmp/a.out+0x128c) in main
==3511584==ABORTING
```
## Environment
* Reproduced on GCC 13.3.0 (Ubuntu 24.04 WSL2)
* Reproduced on GCC 15.2.0 (NixOS multi-user installation on Ubuntu 24.04 WSL2)
* Reproduced on Clang 21.1.7 (NixOS multi-user installation on Ubuntu 24.04 WSL2)
* Operating System: Ubuntu 24.04 WSL2
## Expected Behaviour
ASAN should interpret `(size_t)-1` as `SIZE_MAX` (a very large positive unsigned integer) and process the string up to the `L'\0'` null-terminator without raising a `negative-size-param` error.
Contributor guide
Assessment
This issue has not been assessed yet.