[Bug libc/15674] New: __memcmp_ssse3 tries to read past the array bounary

[Bug libc/15674] New: __memcmp_ssse3 tries to read past the array bounary

[ronis at google dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=15674

            Bug ID: 15674
           Summary: __memcmp_ssse3 tries to read past the array bounary
           Product: glibc
           Version: 2.18
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: ronis at google dot com
                CC: drepper.fsp at gmail dot com

Created attachment 7093
  --> http://sourceware.org/bugzilla/attachment.cgi?id=7093&action=edit
patch for glibc/string/test-memcmp.c

Hello,

The bug occurrs when "memcmp(s1, s2, 72)" calls __memcmp_ssse3, and when (s1 +
72) coinsides with a page boundary.

The instruction 

mov    -9(%rdi), %eax

in __memcmp_ssse3 () at ../sysdeps/x86_64/multiarch/memcmp-ssse3.S:1467 causes
a segmentation fault.

Example: the page is at the address range 0x2000 - 0x3000, s1=(0x3000 - 72),
and the next page is mprotected with PROT_NONE. $rdi=0x3008, and the "mov"
instruction tries to read 4 bytes starting at 0x3008-9, crossing the boundary.

The test case fails for the number of array sizes (72 is just one of them).
Other sizes are 48, 65-75, etc. 


The reported glibc version is 2.18, but the same issue occurs in 2.15.


How to reproduce:

(1) Modify glibc/string/test-memcmp.c (the patch is attached)

(2) Run "env LANGUAGE=C LC_ALL=C make check"

test-memcmp-ifunc will fail with segfault. In string/test-memcmp-ifunc.out:

.....
check2: length=48, simple_memcmp
check2: length=48, __memcmp_sse4_1
check2: length=48, __memcmp_ssse3


Thank you.

Roni.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/15674] __memcmp_ssse3 tries to read past the array bounary

[ronis at google dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=15674

Roni Simonian <ronis at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ppluzhnikov at google dot com,
                   |                            |ronis at google dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/15674] __memcmp_ssse3 tries to read past the array bounary

[ppluzhnikov at google dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=15674

--- Comment #1 from Paul Pluzhnikov <ppluzhnikov at google dot com> ---
Google ref b/9530601

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/15674] __memcmp_ssse3 tries to read past the array bounary

[aj at suse dot de]

http://sourceware.org/bugzilla/show_bug.cgi?id=15674

Andreas Jaeger <aj at suse dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aj at suse dot de
           Assignee|unassigned at sourceware dot org   |liubov.dmitrieva at gmail dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/15674] __memcmp_ssse3 tries to read past the array bounary

[liubov.dmitrieva at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=15674

--- Comment #2 from Liubov Dmitrieva <liubov.dmitrieva at gmail dot com> ---
This patch fixes the issue. Tested on my machines.

diff --git a/sysdeps/x86_64/multiarch/memcmp-ssse3.S
b/sysdeps/x86_64/multiarch/memcmp-ssse3.S
index bdd2ed2..e319df9 100644
--- a/sysdeps/x86_64/multiarch/memcmp-ssse3.S
+++ b/sysdeps/x86_64/multiarch/memcmp-ssse3.S
@@ -1463,10 +1463,8 @@ L(next_24_bytes):
        test    $0x40, %dh
        jnz     L(Byte22)

-       mov     -9(%rdi), %eax
-       and     $0xff, %eax
-       mov     -9(%rsi), %edx
-       and     $0xff, %edx
+       movzbl  -9(%rdi), %eax
+       movzbl  -9(%rsi), %edx
        sub     %edx, %eax
        ret
 # else

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/15674] __memcmp_ssse3 tries to read past the array bounary

[neleai at seznam dot cz]

http://sourceware.org/bugzilla/show_bug.cgi?id=15674

--- Comment #3 from Ondrej Bilka <neleai at seznam dot cz> ---
On Tue, Jun 25, 2013 at 12:51:02PM +0000, liubov.dmitrieva at gmail dot com
wrote:
> http://sourceware.org/bugzilla/show_bug.cgi?id=15674
> 
> --- Comment #2 from Liubov Dmitrieva <liubov.dmitrieva at gmail dot com> ---
> This patch fixes the issue. Tested on my machines.
> 
> diff --git a/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> b/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> index bdd2ed2..e319df9 100644
> --- a/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> +++ b/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> @@ -1463,10 +1463,8 @@ L(next_24_bytes):
>         test    $0x40, %dh
>         jnz     L(Byte22)
> 
> -       mov     -9(%rdi), %eax
> -       and     $0xff, %eax
> -       mov     -9(%rsi), %edx
> -       and     $0xff, %edx
> +       movzbl  -9(%rdi), %eax
> +       movzbl  -9(%rsi), %edx
>         sub     %edx, %eax
>         ret
>  # else
> 
Could you send this to libc-alpha. Where was problem? This code looks at first
glance equivalent.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

Re: [Bug libc/15674] __memcmp_ssse3 tries to read past the array bounary

[Ondřej Bílka]

On Tue, Jun 25, 2013 at 12:51:02PM +0000, liubov.dmitrieva at gmail dot com wrote:
> http://sourceware.org/bugzilla/show_bug.cgi?id=15674
> 
> --- Comment #2 from Liubov Dmitrieva <liubov.dmitrieva at gmail dot com> ---
> This patch fixes the issue. Tested on my machines.
> 
> diff --git a/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> b/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> index bdd2ed2..e319df9 100644
> --- a/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> +++ b/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> @@ -1463,10 +1463,8 @@ L(next_24_bytes):
>         test    $0x40, %dh
>         jnz     L(Byte22)
> 
> -       mov     -9(%rdi), %eax
> -       and     $0xff, %eax
> -       mov     -9(%rsi), %edx
> -       and     $0xff, %edx
> +       movzbl  -9(%rdi), %eax
> +       movzbl  -9(%rsi), %edx
>         sub     %edx, %eax
>         ret
>  # else
> 
Could you send this to libc-alpha. Where was problem? This code looks at first
glance equivalent.

[Bug libc/15674] __memcmp_ssse3 tries to read past the array bounary

[liubov.dmitrieva at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=15674

--- Comment #4 from Liubov Dmitrieva <liubov.dmitrieva at gmail dot com> ---
(In reply to Ondrej Bilka from comment #3)
> On Tue, Jun 25, 2013 at 12:51:02PM +0000, liubov.dmitrieva at gmail dot com
> wrote:
> > http://sourceware.org/bugzilla/show_bug.cgi?id=15674
> > 
> > --- Comment #2 from Liubov Dmitrieva <liubov.dmitrieva at gmail dot com> ---
> > This patch fixes the issue. Tested on my machines.
> > 
> > diff --git a/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> > b/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> > index bdd2ed2..e319df9 100644
> > --- a/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> > +++ b/sysdeps/x86_64/multiarch/memcmp-ssse3.S
> > @@ -1463,10 +1463,8 @@ L(next_24_bytes):
> >         test    $0x40, %dh
> >         jnz     L(Byte22)
> > 
> > -       mov     -9(%rdi), %eax
> > -       and     $0xff, %eax
> > -       mov     -9(%rsi), %edx
> > -       and     $0xff, %edx
> > +       movzbl  -9(%rdi), %eax
> > +       movzbl  -9(%rsi), %edx
> >         sub     %edx, %eax
> >         ret
> >  # else
> > 
> Could you send this to libc-alpha. Where was problem? This code looks at
> first
> glance equivalent.

Ok. I will send.

Movzbl reads only one byte and doesn't cross the boundary. 
Mov reads 4 bytes.
For MOVZBL, the low 8 bits of the destination are replaced by the source
operand. the top 24 bits are set to 0. The source operand is unaffected.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/15674] __memcmp_ssse3 tries to read past the array bounary

[aj at suse dot de]

http://sourceware.org/bugzilla/show_bug.cgi?id=15674

--- Comment #5 from Andreas Jaeger <aj at suse dot de> ---
I suggest you add a comment that you only do single byte reads to not cross
page boundaries.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/15674] __memcmp_ssse3 tries to read past the array bounary

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=15674

--- Comment #6 from H.J. Lu <hjl.tools at gmail dot com> ---
Fixed by

http://sourceware.org/git/?p=glibc.git;a=commit;h=11b8a0e1d7b6175470ffc9077e94104c896093b7

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/15674] __memcmp_ssse3 tries to read past the array bounary

[jsm28 at gcc dot gnu.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=15674

Joseph Myers <jsm28 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Joseph Myers <jsm28 at gcc dot gnu.org> ---
Fixed.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/15674] __memcmp_ssse3 tries to read past the array boundary

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=15674

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
            Version|2.18                        |2.17
            Summary|__memcmp_ssse3 tries to     |__memcmp_ssse3 tries to
                   |read past the array bounary |read past the array
                   |                            |boundary
              Flags|                            |security+

--- Comment #8 from Florian Weimer <fweimer at redhat dot com> ---
Introduced in glibc 2.15, fixed in glibc 2.18.

-- 
You are receiving this mail because:
You are on the CC list for the bug.