This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
[PATCH] tile: Check for pointer add overflow in memchr
- From: Chris Metcalf <cmetcalf at mellanox dot com>
- To: libc-alpha at sourceware dot org
- Cc: Chris Metcalf <cmetcalf at mellanox dot com>
- Date: Thu, 12 Jan 2017 16:37:27 -0500
- Subject: [PATCH] tile: Check for pointer add overflow in memchr
- Authentication-results: sourceware.org; auth=none
As was done in b224637928e9, check for large size causing an overflow
in the loop that walks over the array.
---
2017-01-12 Chris Metcalf <cmetcalf@mellanox.com>
* sysdeps/tile/tilegx/memchr.c (__memchr): Properly handle
overflow for large sizes.
* sysdeps/tile/tilepro/memchr.c (__memchr): Likewise.
sysdeps/tile/tilegx/memchr.c | 4 ++++
sysdeps/tile/tilepro/memchr.c | 4 ++++
2 files changed, 8 insertions(+)
diff --git a/sysdeps/tile/tilegx/memchr.c b/sysdeps/tile/tilegx/memchr.c
index 34df19d2319c..24a9e8aaa3fb 100644
--- a/sysdeps/tile/tilegx/memchr.c
+++ b/sysdeps/tile/tilegx/memchr.c
@@ -51,6 +51,10 @@ __memchr (const void *s, int c, size_t n)
/* Compute the address of the last byte. */
last_byte_ptr = (const char *) s + n - 1;
+ /* Handle possible addition overflow. */
+ if (__glibc_unlikely ((unsigned long) last_byte_ptr < (unsigned long) s))
+ last_byte_ptr = (const char *) UINTPTR_MAX;
+
/* Compute the address of the word containing the last byte. */
last_word_ptr = (const uint64_t *) ((uintptr_t) last_byte_ptr & -8);
diff --git a/sysdeps/tile/tilepro/memchr.c b/sysdeps/tile/tilepro/memchr.c
index 1848a9cadb2d..5bc8ae3a2cbc 100644
--- a/sysdeps/tile/tilepro/memchr.c
+++ b/sysdeps/tile/tilepro/memchr.c
@@ -51,6 +51,10 @@ __memchr (const void *s, int c, size_t n)
/* Compute the address of the last byte. */
last_byte_ptr = (const char *) s + n - 1;
+ /* Handle possible addition overflow. */
+ if (__glibc_unlikely ((unsigned long) last_byte_ptr < (unsigned long) s))
+ last_byte_ptr = (const char *) UINTPTR_MAX;
+
/* Compute the address of the word containing the last byte. */
last_word_ptr = (const uint32_t *) ((uintptr_t) last_byte_ptr & -4);
--
2.7.2