Fix i686 memchr for large input sizes

Similar to BZ#19387 and BZ#20971, both i686 memchr optimized assembly
implementations (memchr-sse2-bsf and memchr-sse2) do not handle the
size overflow correctly.

It is shown by the new tests added by commit 3daef2c8ee4df29, where
both implementation fails with size as SIZE_MAX.

This patch uses a similar strategy used on 3daef2c8ee4df2, where
saturared math is used for overflow case.

Checked on i686-linux-gnu.

	[BZ #21014]
	* sysdeps/i386/i686/multiarch/memchr-sse2-bsf.S (MEMCHR): Avoid overflow
	in pointer addition.
	* sysdeps/i386/i686/multiarch/memchr-sse2.S (MEMCHR): Likewise.

diff --git a/ChangeLog b/ChangeLog
index a98aea2..d321a89 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2017-01-02  Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+
+       [BZ #21014]
+       * sysdeps/i386/i686/multiarch/memchr-sse2-bsf.S (MEMCHR): Avoid overflow
+       in pointer addition.
+       * sysdeps/i386/i686/multiarch/memchr-sse2.S (MEMCHR): Likewise.
+
 2017-01-02  Torvald Riegel  <triegel@redhat.com>
 
        * sysdeps/sparc/nptl/bits/pthreadtypes.h (pthread_cond_t): Adapt to

diff --git a/sysdeps/i386/i686/multiarch/memchr-sse2-bsf.S b/sysdeps/i386/i686/multiarch/memchr-sse2-bsf.S
index c035329..dd31648 100644 (file)
--- a/sysdeps/i386/i686/multiarch/memchr-sse2-bsf.S
+++ b/sysdeps/i386/i686/multiarch/memchr-sse2-bsf.S
@@ -149,9 +149,15 @@ L(crosscache):
        .p2align 4
 L(unaligned_no_match):
 # ifndef USE_AS_RAWMEMCHR
-       sub     $16, %edx
+        /* Calculate the last acceptable address and check for possible
+           addition overflow by using satured math:
+           edx = ecx + edx
+           edx |= -(edx < ecx)  */
        add     %ecx, %edx
-       jle     L(return_null)
+       sbb     %eax, %eax
+       or      %eax, %edx
+       sub     $16, %edx
+       jbe     L(return_null)
        add     $16, %edi
 # else
        add     $16, %edx

diff --git a/sysdeps/i386/i686/multiarch/memchr-sse2.S b/sysdeps/i386/i686/multiarch/memchr-sse2.S
index f1a11b5..910679c 100644 (file)
--- a/sysdeps/i386/i686/multiarch/memchr-sse2.S
+++ b/sysdeps/i386/i686/multiarch/memchr-sse2.S
@@ -118,8 +118,14 @@ L(crosscache):
 # ifndef USE_AS_RAWMEMCHR
        jnz     L(match_case2_prolog1)
        lea     -16(%edx), %edx
+        /* Calculate the last acceptable address and check for possible
+           addition overflow by using satured math:
+           edx = ecx + edx
+           edx |= -(edx < ecx)  */
        add     %ecx, %edx
-       jle     L(return_null)
+       sbb     %eax, %eax
+       or      %eax, %edx
+       jbe     L(return_null)
        lea     16(%edi), %edi
 # else
        jnz     L(match_case1_prolog1)