[Bug string/29422] New: unexpected result occured in strcpy function (i386, with __strcpy_sse2)

[Bug string/29422] New: unexpected result occured in strcpy function (i386, with __strcpy_sse2)

[bww9643 at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29422

            Bug ID: 29422
           Summary: unexpected result occured in strcpy function (i386,
                    with __strcpy_sse2)
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: string
          Assignee: unassigned at sourceware dot org
          Reporter: bww9643 at gmail dot com
  Target Milestone: ---

function related with "sse" register or instruction can copy more than 4bytes
with xmm() register. However, unexpected error occured with this testcase:

```
Linux ubuntu 5.15.0-41-generic #44~20.04.1-Ubuntu SMP Fri Jun 24 13:27:29 UTC
2022 x86_64 x86_64 x86_64 GNU/Linux
~ > cat test.c
#include<stdio.h>
#include<string.h>
#include<stdlib.h>

char a[1024];

int main(){
        strcpy(a,"0123456789abcd");
        printf("%s\n", a);
        strcpy(a,a+2);
        printf("%s\n", a);
        strcpy(a,a+2);
        printf("%s\n", a);
        strcpy(a,a+2);
        printf("%s", a);
        return 0;
}
~ > gcc -m32 -o test test.c
~ > ./test
0123456789abcd
23456989abcd
456989abcd
6989abcd%
```

expected result:
0123456789abcd
23456789abcd
456789abcd
6789abcd

root cause:

!> register environment before execute following instructions:
ecx is ptr of a+2
edx is ptr of a
0xf7d60580 <__strcpy_sse2+1408> movlpd xmm0, QWORD PTR [ecx]
0xf7d60584 <__strcpy_sse2+1412> movlpd QWORD PTR [edx], xmm0
0xf7d60588 <__strcpy_sse2+1416> movlpd xmm0, QWORD PTR [ecx+0x5]
0xf7d6058d <__strcpy_sse2+1421> movlpd QWORD PTR [edx+0x5], xmm0

in mode -m32, `strcpy` use specific function `__strcpy_sse2`.
This function is operated with raw assembly code. (ext: .S)

it applys this following process:
    1. check string's length and jmp to each case.
    2. instruction pointer jumps exact line when string's length is 14.
    3. save xmm0 to "23456789" (start with ptr+2) and overwrite ptr
        result : "2345678989abcd"
    4. save xmm0 to "989abcd\0" (start with ptr+7) and overwrite ptr+5
        result : "23456989abcd" (unexpected!)

Idk why this code should be written with this flow.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug string/29422] unexpected result occured in strcpy function (i386, with __strcpy_sse2)

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29422

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #1 from Andreas Schwab <schwab@linux-m68k.org> ---
Overlapping copies have undefined behaviour.

-- 
You are receiving this mail because:
You are on the CC list for the bug.