mirror/glibc
2
0
Fork 0
mirror of git://sourceware.org/git/glibc.git synced 2025-01-30 12:31:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

x86: Fix wcsnlen-avx2 page cross length comparison [BZ #29591]

Browse Source 
Previous implementation was adjusting length (rsi) to match
bytes (eax), but since there is no bound to length this can cause
overflow.

Fix is to just convert the byte-count (eax) to length by dividing by
sizeof (wchar_t) before the comparison.

Full check passes on x86-64 and build succeeds w/ and w/o multiarch.
This commit is contained in:
Noah Goldstein 2022-09-20 17:58:04 -07:00
parent 3e5760fcb4
commit b0969fa53a
2 changed files with 39 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
string/test-strnlen.c
View File

@ -73,7 +73,7 @@ do_test (size_t align, size_t len, size_t maxlen, int max_char)
{ {
size_t i; size_t i;
align &= 63; align &= (getpagesize () / sizeof (CHAR) - 1);
if ((align + len) * sizeof (CHAR) >= page_size) if ((align + len) * sizeof (CHAR) >= page_size)
return; return;
@ -90,37 +90,49 @@ do_test (size_t align, size_t len, size_t maxlen, int max_char)
static void static void
do_overflow_tests (void) do_overflow_tests (void)
{ {
size_t i, j, len; size_t i, j, al_idx, repeats, len;
const size_t one = 1; const size_t one = 1;
uintptr_t buf_addr = (uintptr_t) buf1; uintptr_t buf_addr = (uintptr_t) buf1;
const size_t alignments[] = { 0, 1, 7, 9, 31, 33, 63, 65, 95, 97, 127, 129 };
for (al_idx = 0; al_idx < sizeof (alignments) / sizeof (alignments[0]);
al_idx++)
{
for (repeats = 0; repeats < 2; ++repeats)
{
size_t align = repeats ? (getpagesize () - alignments[al_idx])
: alignments[al_idx];
align /= sizeof (CHAR);
for (i = 0; i < 750; ++i) for (i = 0; i < 750; ++i)
{ {
do_test (1, i, SIZE_MAX, BIG_CHAR); do_test (align, i, SIZE_MAX, BIG_CHAR);
do_test (0, i, SIZE_MAX - i, BIG_CHAR); do_test (align, i, SIZE_MAX - i, BIG_CHAR);
do_test (0, i, i - buf_addr, BIG_CHAR); do_test (align, i, i - buf_addr, BIG_CHAR);
do_test (0, i, -buf_addr - i, BIG_CHAR); do_test (align, i, -buf_addr - i, BIG_CHAR);
do_test (0, i, SIZE_MAX - buf_addr - i, BIG_CHAR); do_test (align, i, SIZE_MAX - buf_addr - i, BIG_CHAR);
do_test (0, i, SIZE_MAX - buf_addr + i, BIG_CHAR); do_test (align, i, SIZE_MAX - buf_addr + i, BIG_CHAR);
len = 0; len = 0;
for (j = 8 * sizeof (size_t) - 1; j; --j) for (j = 8 * sizeof (size_t) - 1; j; --j)
{ {
len |= one << j; len |= one << j;
do_test (0, i, len - i, BIG_CHAR); do_test (align, i, len, BIG_CHAR);
do_test (0, i, len + i, BIG_CHAR); do_test (align, i, len - i, BIG_CHAR);
do_test (0, i, len - buf_addr - i, BIG_CHAR); do_test (align, i, len + i, BIG_CHAR);
do_test (0, i, len - buf_addr + i, BIG_CHAR); do_test (align, i, len - buf_addr - i, BIG_CHAR);
do_test (align, i, len - buf_addr + i, BIG_CHAR);
do_test (0, i, ~len - i, BIG_CHAR); do_test (align, i, ~len - i, BIG_CHAR);
do_test (0, i, ~len + i, BIG_CHAR); do_test (align, i, ~len + i, BIG_CHAR);
do_test (0, i, ~len - buf_addr - i, BIG_CHAR); do_test (align, i, ~len - buf_addr - i, BIG_CHAR);
do_test (0, i, ~len - buf_addr + i, BIG_CHAR); do_test (align, i, ~len - buf_addr + i, BIG_CHAR);
do_test (0, i, -buf_addr, BIG_CHAR); do_test (align, i, -buf_addr, BIG_CHAR);
do_test (0, i, j - buf_addr, BIG_CHAR); do_test (align, i, j - buf_addr, BIG_CHAR);
do_test (0, i, -buf_addr - j, BIG_CHAR); do_test (align, i, -buf_addr - j, BIG_CHAR);
}
}
} }
} }
} }

7
sysdeps/x86_64/multiarch/strlen-avx2.S
View File

@ -544,14 +544,11 @@ L(return_vzeroupper):
L(cross_page_less_vec): L(cross_page_less_vec):
tzcntl %eax, %eax tzcntl %eax, %eax
# ifdef USE_AS_WCSLEN # ifdef USE_AS_WCSLEN
/* NB: Multiply length by 4 to get byte count. */ /* NB: Divide by 4 to convert from byte-count to length. */
sall $2, %esi shrl $2, %eax
# endif # endif
cmpq %rax, %rsi cmpq %rax, %rsi
cmovb %esi, %eax cmovb %esi, %eax
# ifdef USE_AS_WCSLEN
shrl $2, %eax
# endif
VZEROUPPER_RETURN VZEROUPPER_RETURN
# endif # endif