full-disclosure - Re: Firefox 2.0.0.7 has a very serious calculation bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0709282157080.16489@dione.cc>
Date: Fri, 28 Sep 2007 22:08:15 +0200 (CEST)
From: Michal Zalewski <lcamtuf@...ne.cc>
To: Rodrigo Barbosa <rodrigob@...kover.org>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Firefox 2.0.0.7 has a very serious
 calculation bug

On Fri, 28 Sep 2007, Rodrigo Barbosa wrote:

>> volatile double a = 5.2;
>> volatile double b = 0.1;
>> main() { printf("%.16lf\n",a-b); }
> Isn't this the same issue pointed out by Brian Kim (double to float
> conversion) ?

There is no double to float conversion in the above code.

> Look the results I get for the following code:

> volatile double a = 5.2;
> volatile double b = 0.1;
>         printf("%.16lf\n",a);
>         printf("%.16lf\n",b);
>         printf("%.16lf\n",(volatile double) 5.1);
>         printf("%.16lf\n",(volatile double)((float) 5.1));
>         printf("%.16lf\n",a-b);

There is no double to float conversion in your code, either. There is a
float to double conversion, to which you point, but it has pretty much
nothing to do with the discussed behavior of Firefox (or my code snippet),
and produces a distinctive result (5.0999999046325684).

I'm also puzzled as to why you typecast printf parameters to volatile.

Floating point integers are inherently inaccurate; many numbers cannot be
accurately represented in this format (5.2 being no exception) - and small
errors are introduced and propagated through calculations. This is a
well-documented and well-understood property, and really the only way such
calculations could realistically be performed using small, constrained
datatypes and sane FPU designs.

It's not a security problem, either, unless a misguided application
programmer expects the calculations to have some magical unconstrained
precision (yet fails to use specialized scientific libraries to get close
to this goal), and makes critical decisions based on these made up
expectations. That's not a problem with Firefox, though.

Really...
http://en.wikipedia.org/wiki/IEEE_754

/mz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/