[newlib-cygwin/main] libc: string: Fix off-by-one alignment bug in memrchr.

Jeff Johnston jjohnstn@sourceware.org
Thu Mar 19 15:26:43 GMT 2026


https://sourceware.org/git/gitweb.cgi?p=newlib-cygwin.git;h=4f9fa1ec313f93b125304c91ffe5191111e31592

commit 4f9fa1ec313f93b125304c91ffe5191111e31592
Author: Daniele Cattaneo <daniele.cattaneo@polimi.it>
Date:   Wed Mar 18 17:33:02 2026 +0100

    libc: string: Fix off-by-one alignment bug in memrchr.
    
    The loop at line 50 should test the bytes in the buffer, from the end
    towards the beginning, until it reaches a character whose address is
    aligned, leaving `src' pointing to the next character to test. However,
    the loop condition did not test the address of the last character read
    (`src + 1'), but the address of the next character (`src'). As a
    consequence, a misaligned address was computed at line 69, because the
    (aligned) address in `src' is incremented by 1.
    
    This bug was originally introduced in commit c9b74e328 during a
    refactoring of the macros used by string functions. Before the
    refactoring, the +1 increment in the loop condition was located in the
    macros specific to memrchr.

Diff:
---
 newlib/libc/string/memrchr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/newlib/libc/string/memrchr.c b/newlib/libc/string/memrchr.c
index 0a0c80fd9..b56e2b476 100644
--- a/newlib/libc/string/memrchr.c
+++ b/newlib/libc/string/memrchr.c
@@ -47,7 +47,7 @@ memrchr (const void *src_void,
   unsigned long  mask;
   unsigned int i;
 
-  while (UNALIGNED_X(src))
+  while (UNALIGNED_X(src + 1))
     {
       if (!length--)
         return NULL;


More information about the Newlib-cvs mailing list