about summary refs log tree commit diff
path: root/sysdeps/i386
diff options
context:
space:
mode:
authorAdhemerval Zanella <adhemerval.zanella@linaro.org>2017-03-14 14:16:13 -0300
committerAdhemerval Zanella <adhemerval.zanella@linaro.org>2017-03-29 09:54:14 -0300
commit3abeeec5f46ff036bd9df60bb096e20314ccd078 (patch)
tree19bd5fb7c5a9f965e69242169e08053985cdae3d /sysdeps/i386
parent29d92a8edabed7a1e062fc301bb127d734ec0c45 (diff)
downloadglibc-3abeeec5f46ff036bd9df60bb096e20314ccd078.tar.gz
glibc-3abeeec5f46ff036bd9df60bb096e20314ccd078.tar.xz
glibc-3abeeec5f46ff036bd9df60bb096e20314ccd078.zip
Fix i686 memchr overflow calculation (BZ#21182)
This patch fixes the regression added by 23d2770 for final address
overflow calculation.  The subtraction of the considered size (16)
at line 120 is at wrong place, for sizes less than 16 subsequent
overflow check will not take in consideration an invalid size (since
the subtraction will be negative).  Also, the lea instruction also
does not raise the carry flag (CF) that is used in subsequent jbe
to check for overflow.

The fix is to follow x86_64 logic from 3daef2c where the overflow
is first check and a sub instruction is issued.  In case of resulting
negative size, CF will be set by the sub instruction and a NULL
result will be returned.  The patch also add similar tests reported
in bug report.

Checked on i686-linux-gnu and x86_64-linux-gnu.

	* string/test-memchr.c (do_test): Add BZ#21182 checks for address
	near end of a page.
	* sysdeps/i386/i686/multiarch/memchr-sse2.S (__memchr): Fix
	overflow calculation.
Diffstat (limited to 'sysdeps/i386')
-rw-r--r--sysdeps/i386/i686/multiarch/memchr-sse2.S2
1 files changed, 1 insertions, 1 deletions
diff --git a/sysdeps/i386/i686/multiarch/memchr-sse2.S b/sysdeps/i386/i686/multiarch/memchr-sse2.S
index 910679cfc0..e41f324a77 100644
--- a/sysdeps/i386/i686/multiarch/memchr-sse2.S
+++ b/sysdeps/i386/i686/multiarch/memchr-sse2.S
@@ -117,7 +117,6 @@ L(crosscache):
 
 # ifndef USE_AS_RAWMEMCHR
 	jnz	L(match_case2_prolog1)
-	lea	-16(%edx), %edx
         /* Calculate the last acceptable address and check for possible
            addition overflow by using satured math:
            edx = ecx + edx
@@ -125,6 +124,7 @@ L(crosscache):
 	add	%ecx, %edx
 	sbb	%eax, %eax
 	or	%eax, %edx
+	sub	$16, %edx
 	jbe	L(return_null)
 	lea	16(%edi), %edi
 # else