about summary refs log tree commit diff
diff options
context:
space:
mode:
authorH.J. Lu <hongjiu.lu@intel.com>2010-02-06 02:13:56 -0800
committerUlrich Drepper <drepper@redhat.com>2010-02-06 02:13:56 -0800
commit70b7d00fc782759f1257001202cc30cb29bae28f (patch)
tree0e793998b4073ab3299a8bf66f3e88e0f06bc69f
parent03849910cd0493dde35315eb0baaaf8d5056d296 (diff)
downloadglibc-70b7d00fc782759f1257001202cc30cb29bae28f.tar.gz
glibc-70b7d00fc782759f1257001202cc30cb29bae28f.tar.xz
glibc-70b7d00fc782759f1257001202cc30cb29bae28f.zip
memchr overshoots on ia64
-rw-r--r--ChangeLog6
-rw-r--r--sysdeps/ia64/memchr.S8
2 files changed, 12 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index a5797eaf88..a68be8002d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2010-02-05  H.J. Lu  <hongjiu.lu@intel.com>
+
+	[BZ #11230]
+	* sysdeps/ia64/memchr.S: Don't read beyond the last byte
+	during recovery.
+
 2010-01-26  Andreas Schwab  <schwab@redhat.com>
 
 	* sysdeps/unix/sysv/linux/s390/s390-32/utmp32.c: Use internal
diff --git a/sysdeps/ia64/memchr.S b/sysdeps/ia64/memchr.S
index cdd71ca5a5..56d8056839 100644
--- a/sysdeps/ia64/memchr.S
+++ b/sysdeps/ia64/memchr.S
@@ -47,7 +47,7 @@
 #define saved_lc	r16
 #define	chr		r17
 #define len		r18
-#define pos0		r20
+#define last		r20
 #define val		r21
 #define tmp		r24
 #define chrx8		r25
@@ -67,6 +67,7 @@ ENTRY(__memchr)
 	mov	saved_pr = pr		// save the predicates
 	.body
 	mov 	ret0 = str
+	add	last = str, in2		// last byte
 	and 	tmp = 7, str		// tmp = str % 8
 	cmp.ne	p7, p0 = r0, r0		// clear p7
 	extr.u	chr = in1, 0, 8		// chr = (unsigned char) in1
@@ -143,7 +144,10 @@ ENTRY(__memchr)
 	ld8	tmp = [ret0];;		// load the first unchecked 8byte
 	xor	aux[1] = tmp, chrx8;;
 	czx1.r	poschr[1] = aux[1];;
-	cmp.ne	p7, p0 = 8, poschr[1]
+	cmp.ne	p7, p0 = 8, poschr[1];;
+(p7)	add	ret0 = addr[MEMLAT+2], poschr[1];;
+(p7)	cmp.geu	p6, p7 = ret0, last	// don't go over the last byte
+(p6)	br.cond.spnt	.notfound;;
 (p7)	br.cond.spnt	.foundit;;
 	adds	ret0 = 8, ret0		// load the next unchecked 8byte
 	br.sptk	.l4;;