Bug 18773

Summary: [Regression] x86-64 strlen reads beyond the end of string
Product: glibc Reporter: H.J. Lu <hjl.tools>
Component: libcAssignee: Not yet assigned to anyone <unassigned>
Status: RESOLVED INVALID    
Severity: normal CC: drepper.fsp, neleai
Priority: P2 Flags: fweimer: security-
Version: 2.21   
Target Milestone: ---   
Host: Target:
Build: Last reconfirmed:

Description H.J. Lu 2015-08-05 12:56:30 UTC 
commit 37bb363f03d75e5e6f2ca45f2c686a3a0167797e
Author: Ondrej Bilka <neleai@seznam.cz>
Date:   Mon Mar 18 07:39:12 2013 +0100

    Faster strlen on x64. 

introduced strlen which reads beyond the end of string:

(gdb) disass
Dump of assembler code for function strlen:
   0x00007ffff6bdcaf0 <+0>:	pxor   %xmm0,%xmm0
   0x00007ffff6bdcaf4 <+4>:	pxor   %xmm1,%xmm1
   0x00007ffff6bdcaf8 <+8>:	pxor   %xmm2,%xmm2
   0x00007ffff6bdcafc <+12>:	pxor   %xmm3,%xmm3
   0x00007ffff6bdcb00 <+16>:	mov    %rdi,%rax
   0x00007ffff6bdcb03 <+19>:	mov    %rdi,%rcx
   0x00007ffff6bdcb06 <+22>:	and    $0xfff,%rcx
   0x00007ffff6bdcb0d <+29>:	cmp    $0xfcf,%rcx
   0x00007ffff6bdcb14 <+36>:	ja     0x7ffff6bdcb80 <strlen+144>
=> 0x00007ffff6bdcb16 <+38>:	movdqu (%rax),%xmm4
...
(gdb) p/x $rax
$2 = 0x1555555eceff

We can use movdqu here only if $rax - 16 within a page.  I will come up
with a run-time testcase later.
Comment 1 Sourceware Commits 2015-08-05 13:50:41 UTC 
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, hjl/pr18773 has been created
        at  b436080ecfbefeaf3d614a27dfd687f6ca56e64c (commit)

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b436080ecfbefeaf3d614a27dfd687f6ca56e64c

commit b436080ecfbefeaf3d614a27dfd687f6ca56e64c
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Wed Aug 5 06:49:44 2015 -0700

    PR 18773 test

-----------------------------------------------------------------------
Comment 2 H.J. Lu 2015-08-05 15:03:17 UTC 
Never mind.
Comment 3 Sourceware Commits 2015-08-05 15:07:45 UTC 
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, hjl/pr18773 has been deleted
       was  b436080ecfbefeaf3d614a27dfd687f6ca56e64c

- Log -----------------------------------------------------------------
b436080ecfbefeaf3d614a27dfd687f6ca56e64c PR 18773 test
-----------------------------------------------------------------------