[PATCH v3] powerpc: strstr optimization

[Joseph Myers]

On Wed, 22 Jul 2015, Carlos O'Donell wrote:

> > If there's a quadratic worst case newly introduced for 2.22, I'd consider 
> > that a security hole (denial of service) that needs to block the release 
> > of 2.22 until it's fixed (possibly by removing the implementation in 
> > question).
> 
> Joseph,
> 
> We have had quadratic worse case in our string routines for years without
> it blocking a release. I agree that it is not the best case for a release

And I believe we established a consensus, when removing the SSE4 
implementation (bug 12100), that such implementations are not suitable for 
inclusion in glibc.

> to have such behaviour, but should it block this release?

As a denial-of-service regression (for any code that may use strstr on 
untrusted inputs), yes.

-- 
Joseph S. Myers
joseph@codesourcery.com