Summary: | wcsnlen length can overflow in page cross case. | ||
---|---|---|---|
Product: | glibc | Reporter: | Noah Goldstein <goldstein.w.n> |
Component: | string | Assignee: | Not yet assigned to anyone <unassigned> |
Status: | RESOLVED FIXED | ||
Severity: | normal | CC: | carlos |
Priority: | P2 | ||
Version: | 2.36 | ||
Target Milestone: | 2.38 | ||
Host: | Target: | ||
Build: | Last reconfirmed: | ||
Attachments: | Fix and test cases. |
Description
Noah Goldstein
2022-09-20 22:55:36 UTC
Created attachment 14340 [details]
Fix and test cases.
Fix, will post once all tests complete.
Fixed in master, 2.37, 2.36, 2.35, 2.34, and 2.33. commit b0969fa53a28b4ab2159806bf6c99a98999502ee Author: Noah Goldstein <goldstein.w.n@gmail.com> Date: Tue Sep 20 17:58:04 2022 -0700 x86: Fix wcsnlen-avx2 page cross length comparison [BZ #29591] Previous implementation was adjusting length (rsi) to match bytes (eax), but since there is no bound to length this can cause overflow. Fix is to just convert the byte-count (eax) to length by dividing by sizeof (wchar_t) before the comparison. Full check passes on x86-64 and build succeeds w/ and w/o multiarch. Additionally fixed in in 2.32, 2.31, 2.30, 2.29, and 2.28 to resolve ifunc backports. |