1d101cdd6SStefan Eßer# Memory Bugs 2d101cdd6SStefan Eßer 3d101cdd6SStefan EßerThis is a list of all of the memory bugs that were found in *released* versions 4d101cdd6SStefan Eßerof `bc`, `dc`, or `bcl`. (Non-released commits with memory bugs do not count.) 5d101cdd6SStefan Eßer 6d101cdd6SStefan EßerI made this list for two reasons: first, so users can know what versions of 7d101cdd6SStefan Eßer`bc`, `dc`, and `bcl` have vulnerabilities, and two, I once had a perfect record 8d101cdd6SStefan Eßerand then found a couple, but forgot and claimed I still had a perfect record 9d101cdd6SStefan Eßerright after, which was embarrassing. 10d101cdd6SStefan Eßer 11d101cdd6SStefan EßerThis list is sorted by the first version a bug exists in, not the last it 12d101cdd6SStefan Eßerexisted in. 13d101cdd6SStefan Eßer 14d101cdd6SStefan Eßer* In versions `1.1.0` until `6.2.0` (inclusive) of `bc` and `dc`, there is a 15d101cdd6SStefan Eßer out of bounds read and write in history when pressing ctrl+r (or any other 16d101cdd6SStefan Eßer unused letter) then inserting two characters. 17d101cdd6SStefan Eßer 18d101cdd6SStefan Eßer The first version without this bug is `6.2.1`. 19d101cdd6SStefan Eßer 20d101cdd6SStefan Eßer* In versions `3.0.0` until `6.0.1` (inclusive) of `bc` and `dc`, there is a 21d101cdd6SStefan Eßer double-free on `SIGINT` when using command-line expressions with `-e` and 22d101cdd6SStefan Eßer `-f`. This was caused by not properly ending a jump series. 23d101cdd6SStefan Eßer 24d101cdd6SStefan Eßer The first version without this bug is `6.0.2`. 25d101cdd6SStefan Eßer 26*a970610aSStefan Eßer* In versions `3.0.0` until `6.7.5` (inclusive) of `bc` and `dc`, there is a 27*a970610aSStefan Eßer possible out-of-bounds read when there is an error flushing `stdout` on exit 28*a970610aSStefan Eßer because such an error would cause `bc` and `dc` to attempt to use a `jmp_buf` 29*a970610aSStefan Eßer when none exists. 30*a970610aSStefan Eßer 31*a970610aSStefan Eßer The first version without this bug is `6.7.6`. 32*a970610aSStefan Eßer 33d101cdd6SStefan Eßer* In versions `5.0.0` until `6.0.4` (inclusive) of `bc`, there is an 34d101cdd6SStefan Eßer out-of-bounds access if a non-local (non-`auto`) variable is set to a string 35d101cdd6SStefan Eßer with `asciify()`, then the function is redefined with a use of the same 36d101cdd6SStefan Eßer non-local variable. 37d101cdd6SStefan Eßer 38d101cdd6SStefan Eßer This happened because strings were stored per-function, and the non-local 39d101cdd6SStefan Eßer variable now had a reference to the string in the old function, which could be 40d101cdd6SStefan Eßer at a higher index than exists in the new function. Strings are stored globally 41d101cdd6SStefan Eßer now, and they are *not* freed once not used. 42d101cdd6SStefan Eßer 43d101cdd6SStefan Eßer The first version without this bug is `6.1.0`. 44d101cdd6SStefan Eßer 45d101cdd6SStefan Eßer* In versions `5.0.0` until `6.0.4` (inclusive) of `bc`, there is another 46d101cdd6SStefan Eßer out-of-bounds access if an array is passed to the `asciify()` built-in 47d101cdd6SStefan Eßer function as the only argument. This happened because arrays are allowed as 48d101cdd6SStefan Eßer function arguments, which allowed them to be used as arguments to `asciify()`, 49d101cdd6SStefan Eßer but they should not have been allowed. However, since they were, the 50d101cdd6SStefan Eßer `asciify()` code tried to access an argument that was not there. 51d101cdd6SStefan Eßer 52d101cdd6SStefan Eßer The first version without this bug is `6.1.0`. 53d101cdd6SStefan Eßer 54d101cdd6SStefan Eßer* In version `6.0.0` of `bcl`, there are several uses of initialized data that 55d101cdd6SStefan Eßer have the same root cause: I forgot to call `memset()` on the per-thread global 56d101cdd6SStefan Eßer data. This is because the data used to be *actually* global, which meant that 57d101cdd6SStefan Eßer it was initialized to zero by the system. This happened because I thought I 58d101cdd6SStefan Eßer had properly hooked Valgrind into my `bcl` tests, but I had not. 59d101cdd6SStefan Eßer 60d101cdd6SStefan Eßer The first version without this bug is `6.0.1`. 61103d7cdfSStefan Eßer 62103d7cdfSStefan Eßer* In version `6.0.0` until `6.2.4` (inclusive) of `bcl`, there is a possible 63103d7cdfSStefan Eßer use-after-free if `bcl_init()` fails. 64103d7cdfSStefan Eßer 65103d7cdfSStefan Eßer The first version without this bug is `6.2.5`. 66