[PATCH] Fix string/stratcliff on IA-64

Jakub Jelinek jakub@redhat.com
Mon Sep 30 07:58:00 GMT 2002


Hi!

strncpy did not handle the case with no '\0' chars in src with
(src + len + 7) & ~7L on page boundary with next page unmapped and where
((src ^ dst) & 7) != 0.
We need to segfault only when we need to use at least a byte from the next
page.
Tested with stratcliff and
#include <sys/mman.h>
#include <string.h>
#include <stdlib.h>

char buf[128] __attribute__((aligned(128)));

int main (int argc, char **argv)
{
  int i, j = atoi(argv[1]);
  char *p = mmap (NULL, 65536, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
  if (p == NULL) abort ();
  memset (p + 65536 - j, 'T', j);
  strncpy (buf, p + 65536 - j, j - 1);
  strncpy (buf, p + 65536 - j, j);
  strncpy (buf, p + 65536 - j, j + 1);
  strncpy (buf, p + 65536 - j, j + 7);
}
for various numbers (always should segfault on 3rd strncpy).
IMHO it is better to deal with this in the recovery code than to slow down
the routine for the common case.

2002-09-30  Jakub Jelinek  <jakub@redhat.com>

	* sysdeps/ia64/strncpy.S: Only segfault in .recovery2 if some bits
	from the next quad are needed.

--- libc/sysdeps/ia64/strncpy.S.jj	2002-04-30 12:53:57.000000000 +0200
+++ libc/sysdeps/ia64/strncpy.S	2002-09-30 16:50:03.000000000 +0200
@@ -1,6 +1,6 @@
 /* Optimized version of the standard strncpy() function.
    This file is part of the GNU C Library.
-   Copyright (C) 2000, 2001 Free Software Foundation, Inc.
+   Copyright (C) 2000, 2001, 2002 Free Software Foundation, Inc.
    Contributed by Dan Pop <Dan.Pop@cern.ch>
 	      and Jakub Jelinek <jakub@redhat.com>.
 
@@ -210,8 +210,11 @@ ENTRY(strncpy)
 	mov	pr = saved_pr, -1	// restore the predicate registers
 	br.ret.sptk.many b0
 .recovery2:
+	add	c = 8, len
 	add	tmp = -8, asrc ;;
-	ld8	r[0] = [tmp]
+	cmp.gtu	p8, p5 = c, thresh ;;
+(p8)	ld8	r[0] = [tmp]
+(p5)	mov	r[0] = r0
 	br.cond.sptk .back2
 .recovery3:
 	add	tmp = -MEMLAT * 8, src ;;

	Jakub



More information about the Libc-hacker mailing list