From 46bff4ca48e6c3b72136af6c38ae9e8bd51ae35e Mon Sep 17 00:00:00 2001 From: Sachin Monga Date: Tue, 13 Oct 2026 12:05:39 -0500 Subject: [PATCH] powerpc: Fix off-by-one in AT_HWCAP4 loop in _dl_procinfo The AT_HWCAP4 case loops "i <= _DL_HWCAP_SIZE" instead of "i < _DL_HWCAP_SIZE" like the other three HWCAP cases, so at i == 32 it evaluates the UB expression "1 << 32" and would index one past the end of _dl_powerpc_cap_flags. LD_SHOW_AUXV=1 on POWER10/POWER11 unconditionally runs this path, so the UB fires on any such system regardless of the actual hwcap value. No AT_HWCAP4 bit is currently assigned, so the out-of-bounds read itself is never reached. Fixes: 3ab9b88e2a ("powerpc: Add HWCAP3/HWCAP4 data to TCB for Power Architecture.") Reviewed-by: Florian Weimer --- sysdeps/powerpc/dl-procinfo.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysdeps/powerpc/dl-procinfo.h b/sysdeps/powerpc/dl-procinfo.h index 585ce41226..abbf1b1fd0 100644 --- a/sysdeps/powerpc/dl-procinfo.h +++ b/sysdeps/powerpc/dl-procinfo.h @@ -219,7 +219,7 @@ _dl_procinfo (unsigned int type, unsigned long int word) /* We have to go through them all because the kernel added the AT_HWCAP4 features starting with the high bits. */ - for (int i = 0; i <= _DL_HWCAP_SIZE; ++i) + for (int i = 0; i < _DL_HWCAP_SIZE; ++i) if (word & (1 << i)) _dl_printf (" %s", _dl_hwcap_string (_DL_HWCAP4_OFFSET + i)); break;