From b2c474f8de4c92bfe7435853a96805ec32d68dfa Mon Sep 17 00:00:00 2001 From: Noah Goldstein Date: Tue, 31 Jan 2023 17:46:56 -0600 Subject: x86: Fix strncat-avx2.S reading past length [BZ #30065] Occurs when `src` has no null-term. Two cases: 1) Zero-length check is doing: ``` test %rdx, %rdx jl L(zero_len) ``` which doesn't actually check zero (was at some point `decq` and the flag never got updated). The fix is just make the flag `jle` i.e: ``` test %rdx, %rdx jle L(zero_len) ``` 2) Length check in page-cross case checking if we should continue is doing: ``` cmpq %r8, %rdx jb L(page_cross_small) ``` which means we will continue searching for null-term if length ends at the end of a page and there was no null-term in `src`. The fix is to make the flag: ``` cmpq %r8, %rdx jbe L(page_cross_small) ``` --- sysdeps/x86_64/multiarch/strncat-avx2.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sysdeps/x86_64/multiarch/strncat-avx2.S') diff --git a/sysdeps/x86_64/multiarch/strncat-avx2.S b/sysdeps/x86_64/multiarch/strncat-avx2.S index b380e8e11c..c2ff202238 100644 --- a/sysdeps/x86_64/multiarch/strncat-avx2.S +++ b/sysdeps/x86_64/multiarch/strncat-avx2.S @@ -66,7 +66,7 @@ ENTRY(STRNCAT) salq $2, %rdx # else test %rdx, %rdx - jl L(zero_len) + jle L(zero_len) # endif vpxor %VZERO_128, %VZERO_128, %VZERO_128 @@ -387,7 +387,7 @@ L(page_cross): subl %esi, %r8d andl $(VEC_SIZE - 1), %r8d cmpq %r8, %rdx - jb L(page_cross_small) + jbe L(page_cross_small) /* Optimizing more aggressively for space as this is very cold code. This saves 2x cache lines. */ -- cgit 1.4.1