[PATCH] Fix string/stratcliff on IA-64
Jakub Jelinek
jakub@redhat.com
Mon Sep 30 07:58:00 GMT 2002
Hi!
strncpy did not handle the case with no '\0' chars in src with
(src + len + 7) & ~7L on page boundary with next page unmapped and where
((src ^ dst) & 7) != 0.
We need to segfault only when we need to use at least a byte from the next
page.
Tested with stratcliff and
#include <sys/mman.h>
#include <string.h>
#include <stdlib.h>
char buf[128] __attribute__((aligned(128)));
int main (int argc, char **argv)
{
int i, j = atoi(argv[1]);
char *p = mmap (NULL, 65536, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
if (p == NULL) abort ();
memset (p + 65536 - j, 'T', j);
strncpy (buf, p + 65536 - j, j - 1);
strncpy (buf, p + 65536 - j, j);
strncpy (buf, p + 65536 - j, j + 1);
strncpy (buf, p + 65536 - j, j + 7);
}
for various numbers (always should segfault on 3rd strncpy).
IMHO it is better to deal with this in the recovery code than to slow down
the routine for the common case.
2002-09-30 Jakub Jelinek <jakub@redhat.com>
* sysdeps/ia64/strncpy.S: Only segfault in .recovery2 if some bits
from the next quad are needed.
--- libc/sysdeps/ia64/strncpy.S.jj 2002-04-30 12:53:57.000000000 +0200
+++ libc/sysdeps/ia64/strncpy.S 2002-09-30 16:50:03.000000000 +0200
@@ -1,6 +1,6 @@
/* Optimized version of the standard strncpy() function.
This file is part of the GNU C Library.
- Copyright (C) 2000, 2001 Free Software Foundation, Inc.
+ Copyright (C) 2000, 2001, 2002 Free Software Foundation, Inc.
Contributed by Dan Pop <Dan.Pop@cern.ch>
and Jakub Jelinek <jakub@redhat.com>.
@@ -210,8 +210,11 @@ ENTRY(strncpy)
mov pr = saved_pr, -1 // restore the predicate registers
br.ret.sptk.many b0
.recovery2:
+ add c = 8, len
add tmp = -8, asrc ;;
- ld8 r[0] = [tmp]
+ cmp.gtu p8, p5 = c, thresh ;;
+(p8) ld8 r[0] = [tmp]
+(p5) mov r[0] = r0
br.cond.sptk .back2
.recovery3:
add tmp = -MEMLAT * 8, src ;;
Jakub
More information about the Libc-hacker
mailing list