This is the mail archive of the libc-hacker@sources.redhat.com mailing list for the glibc project.

Note that libc-hacker is a closed list. You may look at the archives of this list, but subscription and posting are not open.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

[PATCH] Fix string/stratcliff on IA-64


Hi!

strncpy did not handle the case with no '\0' chars in src with
(src + len + 7) & ~7L on page boundary with next page unmapped and where
((src ^ dst) & 7) != 0.
We need to segfault only when we need to use at least a byte from the next
page.
Tested with stratcliff and
#include <sys/mman.h>
#include <string.h>
#include <stdlib.h>

char buf[128] __attribute__((aligned(128)));

int main (int argc, char **argv)
{
  int i, j = atoi(argv[1]);
  char *p = mmap (NULL, 65536, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
  if (p == NULL) abort ();
  memset (p + 65536 - j, 'T', j);
  strncpy (buf, p + 65536 - j, j - 1);
  strncpy (buf, p + 65536 - j, j);
  strncpy (buf, p + 65536 - j, j + 1);
  strncpy (buf, p + 65536 - j, j + 7);
}
for various numbers (always should segfault on 3rd strncpy).
IMHO it is better to deal with this in the recovery code than to slow down
the routine for the common case.

2002-09-30  Jakub Jelinek  <jakub@redhat.com>

	* sysdeps/ia64/strncpy.S: Only segfault in .recovery2 if some bits
	from the next quad are needed.

--- libc/sysdeps/ia64/strncpy.S.jj	2002-04-30 12:53:57.000000000 +0200
+++ libc/sysdeps/ia64/strncpy.S	2002-09-30 16:50:03.000000000 +0200
@@ -1,6 +1,6 @@
 /* Optimized version of the standard strncpy() function.
    This file is part of the GNU C Library.
-   Copyright (C) 2000, 2001 Free Software Foundation, Inc.
+   Copyright (C) 2000, 2001, 2002 Free Software Foundation, Inc.
    Contributed by Dan Pop <Dan.Pop@cern.ch>
 	      and Jakub Jelinek <jakub@redhat.com>.
 
@@ -210,8 +210,11 @@ ENTRY(strncpy)
 	mov	pr = saved_pr, -1	// restore the predicate registers
 	br.ret.sptk.many b0
 .recovery2:
+	add	c = 8, len
 	add	tmp = -8, asrc ;;
-	ld8	r[0] = [tmp]
+	cmp.gtu	p8, p5 = c, thresh ;;
+(p8)	ld8	r[0] = [tmp]
+(p5)	mov	r[0] = r0
 	br.cond.sptk .back2
 .recovery3:
 	add	tmp = -MEMLAT * 8, src ;;

	Jakub


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]