Skip to content

split: arithmetic overflow (overflow-checks) on a huge -n l/K/N chunk count #14328

Description

@leeewee

split -n l/K/N FILE with a very large chunk count N panics with attempt to add with overflow under overflow-checks.

$ # a large single-line input (no newlines) — required to iterate the skip loop
$ head -c 100000 /dev/zero | tr '\0' a > big
$ # debug build (overflow-checks on by default) — clean-rebuild to avoid a stale binary
$ cargo build -q -p uu_split --bin split
$ ./target/debug/split -n l/1/9999999999 big >/dev/null
thread 'main' panicked at src/uu/split/src/split.rs:1158:13:
attempt to add with overflow
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
$ echo $?
101

Root cause

In n_chunks_by_line, the per-chunk skip counter is let mut skipped = -1; — inferred as i32 — and is incremented once per chunk while locating the requested Kth chunk; a huge N drives it past i32::MAX. A debug (or release + -C overflow-checks) build aborts (exit 101);
a normal release build wraps silently (exit 0).

let mut skipped = -1;
// Cap at the last chunk to avoid an infinite loop when trailing chunks are
// zero-sized, and keep excess input from indexing past out_files.
while chunk_number < num_chunks && num_bytes_should_be_written <= num_bytes_written {
num_bytes_should_be_written +=
chunk_size_base + (chunk_size_reminder > chunk_number) as u64;
chunk_number += 1;
skipped += 1;
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions