mirror of
https://sourceware.org/git/glibc.git
synced 2024-11-30 00:31:08 +00:00
97700a34f3
On x32, the size_t parameter may be passed in the lower 32 bits of a 64-bit register with the non-zero upper 32 bits. The string/memory functions written in assembly can only use the lower 32 bits of a 64-bit register as length or must clear the upper 32 bits before using the full 64-bit register for length. This pach fixes memchr/wmemchr for x32. Tested on x86-64 and x32. On x86-64, libc.so is the same with and withou the fix. [BZ# 24097] CVE-2019-6488 * sysdeps/x86_64/memchr.S: Use RDX_LP for length. Clear the upper 32 bits of RDX register. * sysdeps/x86_64/multiarch/memchr-avx2.S: Likewise. * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memchr and tst-size_t-wmemchr. * sysdeps/x86_64/x32/test-size_t.h: New file. * sysdeps/x86_64/x32/tst-size_t-memchr.c: Likewise. * sysdeps/x86_64/x32/tst-size_t-wmemchr.c: Likewise.
36 lines
1.2 KiB
C
36 lines
1.2 KiB
C
/* Test string/memory functions with size_t in the lower 32 bits of
|
|
64-bit register.
|
|
Copyright (C) 2019 Free Software Foundation, Inc.
|
|
This file is part of the GNU C Library.
|
|
|
|
The GNU C Library is free software; you can redistribute it and/or
|
|
modify it under the terms of the GNU Lesser General Public
|
|
License as published by the Free Software Foundation; either
|
|
version 2.1 of the License, or (at your option) any later version.
|
|
|
|
The GNU C Library is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Lesser General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Lesser General Public
|
|
License along with the GNU C Library; if not, see
|
|
<http://www.gnu.org/licenses/>. */
|
|
|
|
#define TEST_MAIN
|
|
#include <string/test-string.h>
|
|
|
|
/* On x32, parameter_t may be passed in a 64-bit register with the LEN
|
|
field in the lower 32 bits. When the LEN field of 64-bit register
|
|
is passed to string/memory function as the size_t parameter, only
|
|
the lower 32 bits can be used. */
|
|
typedef struct
|
|
{
|
|
union
|
|
{
|
|
size_t len;
|
|
void (*fn) (void);
|
|
};
|
|
void *p;
|
|
} parameter_t;
|