public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/11230] New: memchr overshoots on ia64
@ 2010-01-28  2:54 jrnieder at gmail dot com
  2010-01-28  3:52 ` [Bug libc/11230] " hjl dot tools at gmail dot com
                   ` (19 more replies)
  0 siblings, 20 replies; 22+ messages in thread
From: jrnieder at gmail dot com @ 2010-01-28  2:54 UTC (permalink / raw)
  To: glibc-bugs

memchr can find a location past the end of its buffer:

#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>

int main(int argc, const char * const argv[])
{
    struct stat st;
    lstat(argv[1], &st);

    int fd = open(argv[1], O_RDONLY);
    void *data = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
    void *t = memchr(data, 0, st.st_size);
    printf("ptr: %p, ret: %p, len: 0x%zx\n", data, t, st.st_size);
    return 0;
}

Example output:
| % ./test /etc/passwd
| ptr: 0x2000000000050000, ret: 0x200000000005040e, len: 0x40e

Tested using Debian libc6.1 2.10.2-5, whose memchr.S matches current glibc HEAD. 
Discovered because git diff uses similar code looking for null bytes to detect 
binary files.

Unfortunately, I do not have an ia64 to test this myself.  Still, I thought you 
might want to know.  Please let me know if any other details would be helpful.

See http://bugs.debian.org/563882 for the original report.  Thanks to Bastian 
Blank for the test case.

-- 
           Summary: memchr overshoots on ia64
           Product: glibc
           Version: 2.11
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: hjl dot tools at gmail dot com
        ReportedBy: jrnieder at gmail dot com
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: ia64-unknown-linux-gnu
  GCC host triplet: ia64-unknown-linux-gnu
GCC target triplet: ia64-unknown-linux-gnu


http://sourceware.org/bugzilla/show_bug.cgi?id=11230

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.


^ permalink raw reply	[flat|nested] 22+ messages in thread
[parent not found: <bug-11230-131@http.sourceware.org/bugzilla/>]
end of thread, other threads:[~2014-06-30 20:12 UTC | newest]

Thread overview: 22+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-01-28  2:54 [Bug libc/11230] New: memchr overshoots on ia64 jrnieder at gmail dot com
2010-01-28  3:52 ` [Bug libc/11230] " hjl dot tools at gmail dot com
2010-01-28  4:44 ` aurelien at aurel32 dot net
2010-01-28  6:37 ` hjl dot tools at gmail dot com
2010-01-28  6:37 ` hjl dot tools at gmail dot com
2010-01-28  8:32 ` aurelien at aurel32 dot net
2010-01-28 14:02 ` hjl dot tools at gmail dot com
2010-02-01 14:55 ` aurelien at aurel32 dot net
2010-02-01 16:50 ` hjl dot tools at gmail dot com
2010-02-01 17:08 ` aurelien at aurel32 dot net
2010-02-01 17:25 ` hjl dot tools at gmail dot com
2010-02-04  0:21 ` pasky at suse dot cz
2010-02-04  1:04 ` hjl dot tools at gmail dot com
2010-02-04  1:22 ` pasky at suse dot cz
2010-02-04  1:33 ` jrnieder at gmail dot com
2010-02-05 14:44 ` hjl dot tools at gmail dot com
2010-02-05 15:09 ` hjl dot tools at gmail dot com
2010-02-05 17:45 ` aurelien at aurel32 dot net
2010-02-05 20:27 ` pasky at suse dot cz
2010-02-06 10:21 ` drepper at redhat dot com
2010-02-08 19:48 ` jrnieder at gmail dot com
     [not found] <bug-11230-131@http.sourceware.org/bugzilla/>
2014-06-30 20:12 ` fweimer at redhat dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).