diff options
author | Noah Goldstein <goldstein.w.n@gmail.com> | 2023-01-31 17:46:56 -0600 |
---|---|---|
committer | Noah Goldstein <goldstein.w.n@gmail.com> | 2023-01-31 19:13:46 -0600 |
commit | b2c474f8de4c92bfe7435853a96805ec32d68dfa (patch) | |
tree | 9175e03c2874fde4bf88c7b8029efe333b93435e /NEWS | |
parent | 5199024232eb9da46150c73af3a198185aa48aa6 (diff) | |
download | glibc-b2c474f8de4c92bfe7435853a96805ec32d68dfa.tar.gz glibc-b2c474f8de4c92bfe7435853a96805ec32d68dfa.tar.xz glibc-b2c474f8de4c92bfe7435853a96805ec32d68dfa.zip |
x86: Fix strncat-avx2.S reading past length [BZ #30065]
Occurs when `src` has no null-term. Two cases: 1) Zero-length check is doing: ``` test %rdx, %rdx jl L(zero_len) ``` which doesn't actually check zero (was at some point `decq` and the flag never got updated). The fix is just make the flag `jle` i.e: ``` test %rdx, %rdx jle L(zero_len) ``` 2) Length check in page-cross case checking if we should continue is doing: ``` cmpq %r8, %rdx jb L(page_cross_small) ``` which means we will continue searching for null-term if length ends at the end of a page and there was no null-term in `src`. The fix is to make the flag: ``` cmpq %r8, %rdx jbe L(page_cross_small) ```
Diffstat (limited to 'NEWS')
0 files changed, 0 insertions, 0 deletions