[Bug string/29234] New: Bug in rawmemchr-avx2 can return incorrect result

[goldstein.w.n at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29234

            Bug ID: 29234
           Summary: Bug in rawmemchr-avx2 can return incorrect result
           Product: glibc
           Version: 2.36
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: string
          Assignee: unassigned at sourceware dot org
          Reporter: goldstein.w.n at gmail dot com
  Target Milestone: ---

commit 6dcbb7d95dded20153b12d76d2f4e0ef0cda4f35
Author: Noah Goldstein <goldstein.w.n@gmail.com>
Date:   Mon Jun 6 21:11:33 2022 -0700

    x86: Shrink code size of memchr-avx2.S


Added a bug to rawmemchr which returns the incorrect result if the pointer is
near the end of a page, there are out of range matches right before the
beginning of pointer, and there is no match between pointer and the end of the
page.

I.e

```

void
bad_rawmemchr() {
    char * buf = mmap(0, 8192, PROT_READ | PROT_WRITE,
                      MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    assert(buf != MAP_FAILED);
    memset(buf, -1, 8192);


    char * ptr_start = buf + 4096 - 8;


    /* Out of range matches. */
    memset(ptr_start - 8, 0x1, 8);

    ptr_start[32] = 0x1;


    /* Fails. */
    assert(rawmemchr_avx2_dev(ptr_start, 0x1) == ptr_start + 32);
}

```

-- 
You are receiving this mail because:
You are on the CC list for the bug.