diff options
| author | Noah Goldstein <goldstein.w.n@gmail.com> | 2021-06-23 01:56:29 -0400 |
|---|---|---|
| committer | Noah Goldstein <goldstein.w.n@gmail.com> | 2021-06-23 14:13:06 -0400 |
| commit | a775a7a3eb1e85b54af0b4ee5ff4dcf66772a1fb (patch) | |
| tree | 966e026527a5b737340f7e5da4ca54da35c75ad5 /sysdeps/x86_64/multiarch/strlen-vec.S | |
| parent | 645a158978f9520e74074e8c14047503be4db0f0 (diff) | |
| download | glibc-a775a7a3eb1e85b54af0b4ee5ff4dcf66772a1fb.tar.gz glibc-a775a7a3eb1e85b54af0b4ee5ff4dcf66772a1fb.tar.xz glibc-a775a7a3eb1e85b54af0b4ee5ff4dcf66772a1fb.zip | |
x86: Fix overflow bug in wcsnlen-sse4_1 and wcsnlen-avx2 [BZ #27974]
This commit fixes the bug mentioned in the previous commit. The previous implementations of wmemchr in these files relied on maxlen * sizeof(wchar_t) which was not guranteed by the standard. The new overflow tests added in the previous commit now pass (As well as all the other tests). Signed-off-by: Noah Goldstein <goldstein.w.n@gmail.com> Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
Diffstat (limited to 'sysdeps/x86_64/multiarch/strlen-vec.S')
| -rw-r--r-- | sysdeps/x86_64/multiarch/strlen-vec.S | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/sysdeps/x86_64/multiarch/strlen-vec.S b/sysdeps/x86_64/multiarch/strlen-vec.S index 8f660bb9c7..439e486a43 100644 --- a/sysdeps/x86_64/multiarch/strlen-vec.S +++ b/sysdeps/x86_64/multiarch/strlen-vec.S @@ -65,12 +65,25 @@ ENTRY(strlen) ret L(n_nonzero): # ifdef AS_WCSLEN - shl $2, %RSI_LP +/* Check for overflow from maxlen * sizeof(wchar_t). If it would + overflow the only way this program doesn't have undefined behavior + is if there is a null terminator in valid memory so wcslen will + suffice. */ + mov %RSI_LP, %R10_LP + sar $62, %R10_LP + test %R10_LP, %R10_LP + jnz __wcslen_sse4_1 + sal $2, %RSI_LP # endif + /* Initialize long lived registers. */ add %RDI_LP, %RSI_LP +# ifdef AS_WCSLEN +/* Check for overflow again from s + maxlen * sizeof(wchar_t). */ + jbe __wcslen_sse4_1 +# endif mov %RSI_LP, %R10_LP and $-64, %R10_LP mov %RSI_LP, %R11_LP |