diff mbox

powerpc: Fix powerpc32/power7 memchr for large input sizes

Message ID 1482522460-26613-1-git-send-email-tuliom@linux.vnet.ibm.com
State New
Headers show

Commit Message

Tulio Magno Quites Machado Filho Dec. 23, 2016, 7:47 p.m. UTC 
The same error fixed in commit b224637928e9fc04e3cef3e10d02ccf042d01584
happens in the 32-bit implementation of memchr for power7.

This patch adopts the same solution, with a minimal change: it
implements a saturated addition where overflows sets the maximum pointer
size to UINTPTR_MAX.

2016-12-23  Tulio Magno Quites Machado Filho  <tuliom@linux.vnet.ibm.com>

	* sysdeps/powerpc/powerpc32/power7/memchr.S (__memchr): Avoid an
	overflow in pointer addition.
---
 sysdeps/powerpc/powerpc32/power7/memchr.S | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

Comments

cseo Dec. 23, 2016, 9:05 p.m. UTC | #1 
On 12/23/16, 5:47 PM, "Tulio Magno Quites Machado Filho" <libc-alpha-owner@sourceware.org on behalf of tuliom@linux.vnet.ibm.com> wrote:

    The same error fixed in commit b224637928e9fc04e3cef3e10d02ccf042d01584
    happens in the 32-bit implementation of memchr for power7.
    
    This patch adopts the same solution, with a minimal change: it
    implements a saturated addition where overflows sets the maximum pointer
    size to UINTPTR_MAX.
    

LGTM
diff mbox

Patch

diff --git a/sysdeps/powerpc/powerpc32/power7/memchr.S b/sysdeps/powerpc/powerpc32/power7/memchr.S
index 318168b..5ce2bb0 100644
--- a/sysdeps/powerpc/powerpc32/power7/memchr.S
+++ b/sysdeps/powerpc/powerpc32/power7/memchr.S
@@ -26,7 +26,16 @@  ENTRY (__memchr)
 	dcbt	0,r3
 	clrrwi  r8,r3,2
 	insrwi	r4,r4,8,16    /* Replicate byte to word.  */
-	add	r7,r3,r5      /* Calculate the last acceptable address.  */
+
+	/* Calculate the last acceptable address and check for possible
+	   addition overflow by using satured math:
+	   r7 = r3 + r5
+	   r7 |= -(r7 < x)  */
+	add     r7,r3,r5
+	subfc   r6,r3,r7
+	subfe   r9,r9,r9
+	or      r7,r7,r9
+
 	insrwi	r4,r4,16,0
 	cmplwi	r5,16
 	li	r9, -1