[Bug libc/15674] __memcmp_ssse3 tries to read past the array bounary

["liubov.dmitrieva at gmail dot com" <sourceware-bugzilla at sourceware dot org>]

http://sourceware.org/bugzilla/show_bug.cgi?id=15674

--- Comment #4 from Liubov Dmitrieva <liubov.dmitrieva at gmail dot com> ---
(In reply to Ondrej Bilka from comment #3)
> On Tue, Jun 25, 2013 at 12:51:02PM +0000, liubov.dmitrieva at gmail dot com
> wrote:
> > http://sourceware.org/bugzilla/show_bug.cgi?id=15674
> > 
> > --- Comment #2 from Liubov Dmitrieva <liubov.dmitrieva at gmail dot com> ---
> > This patch fixes the issue. Tested on my machines.
> > 
> > diff --git a/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> > b/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> > index bdd2ed2..e319df9 100644
> > --- a/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> > +++ b/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> > @@ -1463,10 +1463,8 @@ L(next_24_bytes):
> >         test    $0x40, %dh
> >         jnz     L(Byte22)
> > 
> > -       mov     -9(%rdi), %eax
> > -       and     $0xff, %eax
> > -       mov     -9(%rsi), %edx
> > -       and     $0xff, %edx
> > +       movzbl  -9(%rdi), %eax
> > +       movzbl  -9(%rsi), %edx
> >         sub     %edx, %eax
> >         ret
> >  # else
> > 
> Could you send this to libc-alpha. Where was problem? This code looks at
> first
> glance equivalent.

Ok. I will send.

Movzbl reads only one byte and doesn't cross the boundary. 
Mov reads 4 bytes.
For MOVZBL, the low 8 bits of the destination are replaced by the source
operand. the top 24 bits are set to 0. The source operand is unaffected.

-- 
You are receiving this mail because:
You are on the CC list for the bug.