[Bug libc/21182] segfaults with glibc-2.25 on i686

[leah at vuxu dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=21182

--- Comment #4 from Leah Neukirchen <leah at vuxu dot org> ---
I could reproduce this on Linux 4.4.6 with glibc 2.25 and gcc 6.3.0 directly
running on i686 "Intel(R) Atom(TM) CPU N270   @ 1.60GHz" (no PAE, 1G RAM).

Please consider the test case I just added.  As you can see, addresses which
are less than 16 bytes off the end will result in searching pages behind the
buffer and make memchr return pointers outside of the area.

In a few cases, even different addresses are reported. (This was running inside
gdb.)

src = 0xb7fd5000  src+4096 = 0xb7fd6000
0 (nil)
1 (nil)
2 (nil)
3 (nil)
15 (nil)
16 (nil)
17 (nil)
4080 (nil)
4081 0xb7fda6ed
4082 0xb7fda6ed
4083 0xb7fda6ed
4084 0xb7fd90ff
4094 0xb7fda6ed

Interestingly, valgrind takes no offense and returns (nil) for all inputs.

Merely reverting to glibc 2.24 fixes the issue, making it return (nil) for all
inputs, as expected.

This is a serious regression that makes many programs crash and/or corrupt
memory.



processor       : 1
vendor_id       : GenuineIntel
cpu family      : 6
model           : 28
model name      : Intel(R) Atom(TM) CPU N270   @ 1.60GHz
stepping        : 2
microcode       : 0x212
cpu MHz         : 800.000
cache size      : 512 KB
physical id     : 0
siblings        : 2
core id         : 0
cpu cores       : 1
apicid          : 1
initial apicid  : 1
fdiv_bug        : no
f00f_bug        : no
coma_bug        : no
fpu             : yes
fpu_exception   : yes
cpuid level     : 10
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov
pat clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe nx constant_tsc
arch_perfmon pebs bts aperfmperf pni dtes64 monitor ds_cpl est tm2 ssse3 xtpr
pdcm movbe lahf_lm dtherm
bugs            :
bogomips        : 3191.89
clflush size    : 64
cache_alignment : 64
address sizes   : 32 bits physical, 32 bits virtual
power management:

-- 
You are receiving this mail because:
You are on the CC list for the bug.