diff options
| author | Noah Goldstein <goldstein.w.n@gmail.com> | 2023-01-31 17:46:56 -0600 |
|---|---|---|
| committer | Noah Goldstein <goldstein.w.n@gmail.com> | 2023-01-31 19:13:46 -0600 |
| commit | b2c474f8de4c92bfe7435853a96805ec32d68dfa (patch) | |
| tree | 9175e03c2874fde4bf88c7b8029efe333b93435e /sysdeps/x86_64/multiarch | |
| parent | 5199024232eb9da46150c73af3a198185aa48aa6 (diff) | |
| download | glibc-b2c474f8de4c92bfe7435853a96805ec32d68dfa.tar glibc-b2c474f8de4c92bfe7435853a96805ec32d68dfa.tar.gz glibc-b2c474f8de4c92bfe7435853a96805ec32d68dfa.tar.bz2 glibc-b2c474f8de4c92bfe7435853a96805ec32d68dfa.zip | |
x86: Fix strncat-avx2.S reading past length [BZ #30065]
Occurs when `src` has no null-term.
Two cases:
1) Zero-length check is doing:
```
test %rdx, %rdx
jl L(zero_len)
```
which doesn't actually check zero (was at some point `decq` and the
flag never got updated).
The fix is just make the flag `jle` i.e:
```
test %rdx, %rdx
jle L(zero_len)
```
2) Length check in page-cross case checking if we should continue is
doing:
```
cmpq %r8, %rdx
jb L(page_cross_small)
```
which means we will continue searching for null-term if length ends at
the end of a page and there was no null-term in `src`.
The fix is to make the flag:
```
cmpq %r8, %rdx
jbe L(page_cross_small)
```
Diffstat (limited to 'sysdeps/x86_64/multiarch')
| -rw-r--r-- | sysdeps/x86_64/multiarch/strncat-avx2.S | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sysdeps/x86_64/multiarch/strncat-avx2.S b/sysdeps/x86_64/multiarch/strncat-avx2.S index b380e8e11c..c2ff202238 100644 --- a/sysdeps/x86_64/multiarch/strncat-avx2.S +++ b/sysdeps/x86_64/multiarch/strncat-avx2.S @@ -66,7 +66,7 @@ ENTRY(STRNCAT) salq $2, %rdx # else test %rdx, %rdx - jl L(zero_len) + jle L(zero_len) # endif vpxor %VZERO_128, %VZERO_128, %VZERO_128 @@ -387,7 +387,7 @@ L(page_cross): subl %esi, %r8d andl $(VEC_SIZE - 1), %r8d cmpq %r8, %rdx - jb L(page_cross_small) + jbe L(page_cross_small) /* Optimizing more aggressively for space as this is very cold code. This saves 2x cache lines. */ |