[Bug libc/25620] Signed comparison vulnerability in the ARMv7 memcpy() (CVE-2020-6096)

[carlos at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=25620

--- Comment #9 from Carlos O'Donell <carlos at redhat dot com> ---
(In reply to Richard Earnshaw from comment #8)
> memcpy is only defined if the regions do not overlap.   If the size of the
> copy is more than half the address space, this can never be true, so any
> copy that is mis-interpreted as a negative value must be undefined anyway.

In many cases the implementation chooses what behaviour happens in the
undefined case, and it is always better if we crash early rather than to
continue to operate having copied less data than expected by the API. If we
change the implementation to operate on unsigned values we will eventually
reach an unmapped page (likely) and crash. Crashing is the best outcome in this
case since it prevents the attack from continuing.

-- 
You are receiving this mail because:
You are on the CC list for the bug.