summaryrefslogtreecommitdiff
path: root/x86-Fix-__wcsncmp_avx2-in-strcmp-avx2.S-BZ-28755.patch
diff options
context:
space:
mode:
Diffstat (limited to 'x86-Fix-__wcsncmp_avx2-in-strcmp-avx2.S-BZ-28755.patch')
-rw-r--r--x86-Fix-__wcsncmp_avx2-in-strcmp-avx2.S-BZ-28755.patch40
1 files changed, 40 insertions, 0 deletions
diff --git a/x86-Fix-__wcsncmp_avx2-in-strcmp-avx2.S-BZ-28755.patch b/x86-Fix-__wcsncmp_avx2-in-strcmp-avx2.S-BZ-28755.patch
new file mode 100644
index 0000000..7b8597b
--- /dev/null
+++ b/x86-Fix-__wcsncmp_avx2-in-strcmp-avx2.S-BZ-28755.patch
@@ -0,0 +1,40 @@
+From ddf0992cf57a93200e0c782e2a94d0733a5a0b87 Mon Sep 17 00:00:00 2001
+From: Noah Goldstein <goldstein.w.n@gmail.com>
+Date: Sun, 9 Jan 2022 16:02:21 -0600
+Subject: [PATCH] x86: Fix __wcsncmp_avx2 in strcmp-avx2.S [BZ# 28755]
+
+Fixes [BZ# 28755] for wcsncmp by redirecting length >= 2^56 to
+__wcscmp_avx2. For x86_64 this covers the entire address range so any
+length larger could not possibly be used to bound `s1` or `s2`.
+
+test-strcmp, test-strncmp, test-wcscmp, and test-wcsncmp all pass.
+
+Signed-off-by: Noah Goldstein <goldstein.w.n@gmail.com>
+---
+ sysdeps/x86_64/multiarch/strcmp-avx2.S | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sysdeps/x86_64/multiarch/strcmp-avx2.S b/sysdeps/x86_64/multiarch/strcmp-avx2.S
+index a45f9d2..9c73b58 100644
+--- a/sysdeps/x86_64/multiarch/strcmp-avx2.S
++++ b/sysdeps/x86_64/multiarch/strcmp-avx2.S
+@@ -87,6 +87,16 @@ ENTRY (STRCMP)
+ je L(char0)
+ jb L(zero)
+ # ifdef USE_AS_WCSCMP
++# ifndef __ILP32__
++ movq %rdx, %rcx
++ /* Check if length could overflow when multiplied by
++ sizeof(wchar_t). Checking top 8 bits will cover all potential
++ overflow cases as well as redirect cases where its impossible to
++ length to bound a valid memory region. In these cases just use
++ 'wcscmp'. */
++ shrq $56, %rcx
++ jnz __wcscmp_avx2
++# endif
+ /* Convert units: from wide to byte char. */
+ shl $2, %RDX_LP
+ # endif
+--
+1.8.3.1
+