From ea9b7d9f09d48b2bf88682d47992f5ee0bd4e57d Mon Sep 17 00:00:00 2001 From: Daniele Cattaneo Date: Wed, 18 Mar 2026 17:33:02 +0100 Subject: [PATCH] libc: string: Fix off-by-one alignment bug in memrchr. The loop at line 50 should test the bytes in the buffer, from the end towards the beginning, until it reaches a character whose address is aligned, leaving `src' pointing to the next character to test. However, the loop condition did not test the address of the last character read (`src + 1'), but the address of the next character (`src'). As a consequence, a misaligned address was computed at line 69, because the (aligned) address in `src' is incremented by 1. This bug was originally introduced in commit c9b74e328 during a refactoring of the macros used by string functions. Before the refactoring, the +1 increment in the loop condition was located in the macros specific to memrchr. --- newlib/libc/string/memrchr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/newlib/libc/string/memrchr.c b/newlib/libc/string/memrchr.c index 0a0c80fd9..b56e2b476 100644 --- a/newlib/libc/string/memrchr.c +++ b/newlib/libc/string/memrchr.c @@ -47,7 +47,7 @@ memrchr (const void *src_void, unsigned long mask; unsigned int i; - while (UNALIGNED_X(src)) + while (UNALIGNED_X(src + 1)) { if (!length--) return NULL; -- 2.53.0