diff mbox

tile: Check for pointer add overflow in memchr

Message ID 1484257047-25513-1-git-send-email-cmetcalf@mellanox.com
State New, archived
Headers

Commit Message

Chris Metcalf Jan. 12, 2017, 9:37 p.m. UTC 
  As was done in b224637928e9, check for large size causing an overflow
in the loop that walks over the array.
---
2017-01-12  Chris Metcalf  <cmetcalf@mellanox.com>

	* sysdeps/tile/tilegx/memchr.c (__memchr): Properly handle
	overflow for large sizes.
	* sysdeps/tile/tilepro/memchr.c (__memchr): Likewise.

 sysdeps/tile/tilegx/memchr.c  | 4 ++++
 sysdeps/tile/tilepro/memchr.c | 4 ++++
 2 files changed, 8 insertions(+)

Comments

Adhemerval Zanella Jan. 13, 2017, 10:42 a.m. UTC | #1 
On 12/01/2017 19:37, Chris Metcalf wrote:
> +  /* Handle possible addition overflow.  */
> +  if (__glibc_unlikely ((unsigned long) last_byte_ptr < (unsigned long) s))
> +    last_byte_ptr = (const char *) UINTPTR_MAX;
> +

Wouldn't a branchfree saturating addition be better for tile?
diff mbox

Patch

diff --git a/sysdeps/tile/tilegx/memchr.c b/sysdeps/tile/tilegx/memchr.c
index 34df19d2319c..24a9e8aaa3fb 100644
--- a/sysdeps/tile/tilegx/memchr.c
+++ b/sysdeps/tile/tilegx/memchr.c
@@ -51,6 +51,10 @@  __memchr (const void *s, int c, size_t n)
   /* Compute the address of the last byte. */
   last_byte_ptr = (const char *) s + n - 1;
 
+  /* Handle possible addition overflow.  */
+  if (__glibc_unlikely ((unsigned long) last_byte_ptr < (unsigned long) s))
+    last_byte_ptr = (const char *) UINTPTR_MAX;
+
   /* Compute the address of the word containing the last byte. */
   last_word_ptr = (const uint64_t *) ((uintptr_t) last_byte_ptr & -8);
 
diff --git a/sysdeps/tile/tilepro/memchr.c b/sysdeps/tile/tilepro/memchr.c
index 1848a9cadb2d..5bc8ae3a2cbc 100644
--- a/sysdeps/tile/tilepro/memchr.c
+++ b/sysdeps/tile/tilepro/memchr.c
@@ -51,6 +51,10 @@  __memchr (const void *s, int c, size_t n)
   /* Compute the address of the last byte. */
   last_byte_ptr = (const char *) s + n - 1;
 
+  /* Handle possible addition overflow.  */
+  if (__glibc_unlikely ((unsigned long) last_byte_ptr < (unsigned long) s))
+    last_byte_ptr = (const char *) UINTPTR_MAX;
+
   /* Compute the address of the word containing the last byte. */
   last_word_ptr = (const uint32_t *) ((uintptr_t) last_byte_ptr & -4);