From patchwork Mon Dec 22 19:50:26 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Metcalf X-Patchwork-Id: 4399 Received: (qmail 17420 invoked by alias); 22 Dec 2014 19:57:27 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 17408 invoked by uid 89); 22 Dec 2014 19:57:26 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-1.2 required=5.0 tests=AWL, BAYES_00, RCVD_IN_DNSWL_NONE, SPF_HELO_PASS, SPF_PASS autolearn=ham version=3.3.2 X-HELO: emea01-db3-obe.outbound.protection.outlook.com Message-ID: <201412221953.sBMJrFOu030187@farm-0002.internal.tilera.com> From: Chris Metcalf Date: Mon, 22 Dec 2014 14:50:26 -0500 Subject: [COMMITTED] tilegx: remove implicit boolean conversion in strstr. To: X-EOPAttributedMessage: 0 Received-SPF: Fail (protection.outlook.com: domain of ezchip.com does not designate 12.216.194.146 as permitted sender) receiver=protection.outlook.com; client-ip=12.216.194.146; helo=farm-0002.internal.tilera.com; Authentication-Results: spf=fail (sender IP is 12.216.194.146) smtp.mailfrom=cmetcalf@ezchip.com; X-Forefront-Antispam-Report: CIP:12.216.194.146; CTRY:US; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(10009020)(6009001)(339900001)(189002)(377424004)(199003)(99396003)(103666002)(105606002)(106356001)(21056001)(31966008)(86362001)(19580405001)(87936001)(77156002)(19580395003)(47776003)(6806004)(20776003)(50466002)(64706001)(48376002)(54356999)(62966003)(104016003)(450100001)(2351001)(50986999)(97736003)(120916001)(107886001)(229853001)(92566001)(106466001)(106476002)(110136001)(107046002)(68736005)(46102003)(42186005)(4396001)(9376004); DIR:OUT; SFP:1101; SCL:1; SRVR:DB3PR02MB217; H:farm-0002.internal.tilera.com; FPR:; SPF:Fail; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; MIME-Version: 1.0 X-Microsoft-Antispam: UriScan:; X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;SRVR:DB3PR02MB217; X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(601004); SRVR:DB3PR02MB217; X-Forefront-PRVS: 0433DB2766 X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:;SRVR:DB3PR02MB217; X-OriginatorOrg: ezchip.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Dec 2014 19:53:16.4957 (UTC) X-MS-Exchange-CrossTenant-Id: 0fc16e0a-3cd3-4092-8b2f-0a42cff122c3 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=0fc16e0a-3cd3-4092-8b2f-0a42cff122c3; Ip=[12.216.194.146] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB3PR02MB217 [BZ #17746] The __builtin_expect() truncated a uint64_t to a 32-bit long in ILP32 mode, discarding the high 32 bits, and potentially missing the NUL terminator that we were searching for with SIMD operations. Explicitly compare to zero to fix the problem. --- ChangeLog | 6 ++++++ NEWS | 2 +- sysdeps/tile/tilegx/strstr.c | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 4ad8b90161cf..77abebf47806 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2014-12-22 Chris Metcalf + + [BZ #17746] + * sysdeps/tile/tilegx/strstr.c (STRSTR2): Remove implicit boolean + conversion. + 2014-12-22 Steve Ellcey * sysdeps/unix/mips/sysdep.h (__mips_isa_rev): Set diff --git a/NEWS b/NEWS index cf0756b2e04b..56dfff03bf32 100644 --- a/NEWS +++ b/NEWS @@ -15,7 +15,7 @@ Version 2.21 17522, 17555, 17570, 17571, 17572, 17573, 17574, 17581, 17582, 17583, 17584, 17585, 17589, 17594, 17601, 17608, 17616, 17625, 17630, 17633, 17634, 17647, 17653, 17657, 17664, 17665, 17668, 17682, 17717, 17719, - 17722, 17724, 17725, 17733, 17744, 17745. + 17722, 17724, 17725, 17733, 17744, 17745, 17746. * CVE-2104-7817 The wordexp function could ignore the WRDE_NOCMD flag under certain input conditions resulting in the execution of a shell for diff --git a/sysdeps/tile/tilegx/strstr.c b/sysdeps/tile/tilegx/strstr.c index d04f12910db2..de5adaff91c7 100644 --- a/sysdeps/tile/tilegx/strstr.c +++ b/sysdeps/tile/tilegx/strstr.c @@ -154,7 +154,7 @@ STRSTR2 (const char *haystack_start, const char *needle) /* Look for a terminating '\0'. */ zero_matches = __insn_v1cmpeqi (v, 0); uint64_t byte1_matches = __insn_v1cmpeq (v, byte1); - if (__builtin_expect (zero_matches, 0)) + if (__builtin_expect (zero_matches != 0, 0)) { /* This is the last vector. Don't worry about matches crossing into the next vector. Shift the second byte