qiurui/glibc
1
0
Fork 0
mirror of git://sourceware.org/git/glibc.git synced 2026-10-28 14:16:45 +08:00
Code Issues Packages Projects Releases Wiki Activity

powerpc: Fix off-by-one in AT_HWCAP4 loop in _dl_procinfo

Browse Source 
The AT_HWCAP4 case loops "i <= _DL_HWCAP_SIZE" instead of
"i < _DL_HWCAP_SIZE" like the other three HWCAP cases, so at i == 32
it evaluates the UB expression "1 << 32" and would index one past
the end of _dl_powerpc_cap_flags.  LD_SHOW_AUXV=1 on POWER10/POWER11
unconditionally runs this path, so the UB fires on any such system
regardless of the actual hwcap value.  No AT_HWCAP4 bit is currently
assigned, so the out-of-bounds read itself is never reached.

Fixes: 3ab9b88e2a ("powerpc: Add HWCAP3/HWCAP4 data to TCB for Power Architecture.")
Reviewed-by: Florian Weimer <fweimer@redhat.com>
This commit is contained in:
Sachin Monga
2026-10-13 22:14:06 +05:30
parent cdaa5d6db0
commit 9bc3c99bff
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sysdeps/powerpc/dl-procinfo.h
+1 -1
View File
@@ -219,7 +219,7 @@ _dl_procinfo (unsigned int type, unsigned long int word)
/* We have to go through them all because the kernel added the
AT_HWCAP4 features starting with the high bits. */
for (int i = 0; i <= _DL_HWCAP_SIZE; ++i)
for (int i = 0; i < _DL_HWCAP_SIZE; ++i)
if (word & (1 << i))
_dl_printf (" %s", _dl_hwcap_string (_DL_HWCAP4_OFFSET + i));
break;