Bug 18773 - [Regression] x86-64 strlen reads beyond the end of string
Summary: [Regression] x86-64 strlen reads beyond the end of string
Status: RESOLVED INVALID
Alias: None
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: 2.21
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-08-05 12:56 UTC by H.J. Lu
Modified: 2015-09-04 09:31 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description H.J. Lu 2015-08-05 12:56:30 UTC
commit 37bb363f03d75e5e6f2ca45f2c686a3a0167797e
Author: Ondrej Bilka <neleai@seznam.cz>
Date:   Mon Mar 18 07:39:12 2013 +0100

    Faster strlen on x64. 

introduced strlen which reads beyond the end of string:

(gdb) disass
Dump of assembler code for function strlen:
   0x00007ffff6bdcaf0 <+0>:	pxor   %xmm0,%xmm0
   0x00007ffff6bdcaf4 <+4>:	pxor   %xmm1,%xmm1
   0x00007ffff6bdcaf8 <+8>:	pxor   %xmm2,%xmm2
   0x00007ffff6bdcafc <+12>:	pxor   %xmm3,%xmm3
   0x00007ffff6bdcb00 <+16>:	mov    %rdi,%rax
   0x00007ffff6bdcb03 <+19>:	mov    %rdi,%rcx
   0x00007ffff6bdcb06 <+22>:	and    $0xfff,%rcx
   0x00007ffff6bdcb0d <+29>:	cmp    $0xfcf,%rcx
   0x00007ffff6bdcb14 <+36>:	ja     0x7ffff6bdcb80 <strlen+144>
=> 0x00007ffff6bdcb16 <+38>:	movdqu (%rax),%xmm4
...
(gdb) p/x $rax
$2 = 0x1555555eceff

We can use movdqu here only if $rax - 16 within a page.  I will come up
with a run-time testcase later.
Comment 1 cvs-commit@gcc.gnu.org 2015-08-05 13:50:41 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, hjl/pr18773 has been created
        at  b436080ecfbefeaf3d614a27dfd687f6ca56e64c (commit)

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b436080ecfbefeaf3d614a27dfd687f6ca56e64c

commit b436080ecfbefeaf3d614a27dfd687f6ca56e64c
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Wed Aug 5 06:49:44 2015 -0700

    PR 18773 test

-----------------------------------------------------------------------
Comment 2 H.J. Lu 2015-08-05 15:03:17 UTC
Never mind.
Comment 3 cvs-commit@gcc.gnu.org 2015-08-05 15:07:45 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, hjl/pr18773 has been deleted
       was  b436080ecfbefeaf3d614a27dfd687f6ca56e64c

- Log -----------------------------------------------------------------
b436080ecfbefeaf3d614a27dfd687f6ca56e64c PR 18773 test
-----------------------------------------------------------------------