mirror of
git://sourceware.org/git/glibc.git
synced 2026-10-30 21:07:53 +08:00
Sachin Monga
34106fee69
The Power8 strncasecmp (strcasecmp.S with USE_AS_STRNCASECMP) touches
s1[n]/s2[n] in three places when the first n bytes compare equal and
contain no NUL: L(loop) preloads the next byte before its bdnz;
L(loop1) increments then loads before its bdnz; and L(bytebybyte) loads
s1[0]/s2[0] before checking r5. A caller that maps exactly n readable bytes
can get SIGSEGV if byte n falls on an unmapped page.
The L(bytebybyte) site was identified by Florian Weimer; the
original AISLE report covered only the two loops.
Fix all three sites: guard L(bytebybyte) with a r5 == 0 check, split the
bdnz/load pairs in L(loop) and L(loop1) so the load only runs when the
count is still positive, and preload rCHAR1/rCHAR2 in L(lessthan4) after
confirming r5 != 0. strcasecmp is unaffected; its generated code is
unchanged.
Add string/test-strncasecmp-nonarray.c, built on the test-Xncmp-nonarray.c
skeleton: maps a PROT_NONE page past both buffers and sweeps all start
offsets and lengths. Runs as an xtest.
Reported-by: AISLE in partnership with Red Hat
Suggested-by: Florian Weimer <fweimer@redhat.com>
(cherry picked from commit e622f82ea8)