Do not create invalid pointers in C code of string functions.

Some of the x86 string functions create pointers based on input strings
that may be outside of the input strings.  When this happens in C code,
the compiler can potentially detect this, leading to warnings in
application code when those string functions are inlined.  Perform those
operations in the assembly code instead of the C code to fix this.

diff --git a/ChangeLog b/ChangeLog
index 15deac774f9c4968dd56a420cc6f25393b50fbb7..c6c33562286a290aa5bad0b9d88a2e18d4e8e7d6 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2015-07-07  Torvald Riegel  <triegel@redhat.com>
+
+       [BZ #18633]
+       * sysdeps/x86/bits/string.h (__memmove_g): Do not create invalid
+       pointer in C code.
+       (__strcat_c): Likewise.
+       (__strcat_g): Likewise.
+
 2015-07-07  Cyril Hrubis <chrubis@suse.cz>
 
        [BZ #18592]

diff --git a/NEWS b/NEWS
index 53dea6e4683e07d91964643c6d705048709b6695..569a7d6acc730735b20df37edce0e7fb8b854f28 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -25,7 +25,7 @@ Version 2.22
   18496, 18497, 18498, 18502, 18507, 18512, 18513, 18519, 18520, 18522,
   18527, 18528, 18529, 18530, 18532, 18533, 18534, 18536, 18539, 18540,
   18542, 18544, 18545, 18546, 18547, 18549, 18553, 18558, 18569, 18583,
-  18585, 18586, 18592, 18593, 18594, 18602, 18612, 18613, 18619.
+  18585, 18586, 18592, 18593, 18594, 18602, 18612, 18613, 18619, 18633.
 
 * Cache information can be queried via sysconf() function on s390 e.g. with
   _SC_LEVEL1_ICACHE_SIZE as argument.

diff --git a/sysdeps/x86/bits/string.h b/sysdeps/x86/bits/string.h
index a117f6be1fbf0f45e29a6bf5bba6d1ce1e75db59..4973620b83e34ae39cd6f8a599e7c9e7e7eed6c2 100644 (file)
--- a/sysdeps/x86/bits/string.h
+++ b/sysdeps/x86/bits/string.h
@@ -176,13 +176,15 @@ __memmove_g (void *__dest, const void *__src, size_t __n)
         "m" ( *(struct { __extension__ char __x[__n]; } *)__src));
   else
     __asm__ __volatile__
-      ("std\n\t"
+      ("decl %1\n\t"
+       "decl %2\n\t"
+       "std\n\t"
        "rep; movsb\n\t"
        "cld"
        : "=&c" (__d0), "=&S" (__d1), "=&D" (__d2),
         "=m" ( *(struct { __extension__ char __x[__n]; } *)__dest)
-       : "0" (__n), "1" (__n - 1 + (const char *) __src),
-        "2" (__n - 1 + (char *) __tmp),
+       : "0" (__n), "1" (__n + (const char *) __src),
+        "2" (__n + (char *) __tmp),
         "m" ( *(struct { __extension__ char __x[__n]; } *)__src));
   return __dest;
 }
@@ -999,9 +1001,10 @@ __strcat_c (char *__dest, const char __src[], size_t __srclen)
      : "cc");
   --__tmp;
 # else
-  register char *__tmp = __dest - 1;
+  register char *__tmp = __dest;
   __asm__ __volatile__
-    ("1:\n\t"
+    ("decl     %0\n\t"
+     "1:\n\t"
      "incl     %0\n\t"
      "cmpb     $0,(%0)\n\t"
      "jne      1b\n"
@@ -1020,10 +1023,11 @@ __STRING_INLINE char *__strcat_g (char *__dest, const char *__src);
 __STRING_INLINE char *
 __strcat_g (char *__dest, const char *__src)
 {
-  register char *__tmp = __dest - 1;
+  register char *__tmp = __dest;
   register char __dummy;
   __asm__ __volatile__
-    ("1:\n\t"
+    ("decl     %1\n\t"
+     "1:\n\t"
      "incl     %1\n\t"
      "cmpb     $0,(%1)\n\t"
      "jne      1b\n"