public inbox for glibc-bugs@sourceware.org help / color / mirror / Atom feed
From: "goldstein.w.n at gmail dot com" <sourceware-bugzilla@sourceware.org> To: glibc-bugs@sourceware.org Subject: [Bug string/29591] New: wcsnlen length can overflow in page cross case. Date: Tue, 20 Sep 2022 22:55:36 +0000 [thread overview] Message-ID: <bug-29591-131@http.sourceware.org/bugzilla/> (raw) https://sourceware.org/bugzilla/show_bug.cgi?id=29591 Bug ID: 29591 Summary: wcsnlen length can overflow in page cross case. Product: glibc Version: 2.36 Status: UNCONFIRMED Severity: normal Priority: P2 Component: string Assignee: unassigned at sourceware dot org Reporter: goldstein.w.n at gmail dot com Target Milestone: --- ``` #include <assert.h> #include <stdint.h> #include <string.h> #include <sys/mman.h> #include <wchar.h> #define PAGE_SIZE 4096 static void * make_buf(uint64_t sz) { void * p = mmap(NULL, 2 * PAGE_SIZE + sz, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); assert(p != NULL); assert(!mprotect(p + PAGE_SIZE, sz, PROT_READ | PROT_WRITE)); return p + PAGE_SIZE; } size_t __wcsnlen_avx2(wchar_t const *, size_t); size_t __wcsnlen_evex(wchar_t const *, size_t); int main(int argc, char ** argv) { wchar_t * buf = (wchar_t *)make_buf(PAGE_SIZE); wchar_t * wstr = buf + (PAGE_SIZE / sizeof(wchar_t)) - 2; /* Expect wstr len == 1. */ memset(wstr, -1, sizeof(wchar_t)); memset(wstr + 1, 0, sizeof(wchar_t)); assert(__wcsnlen_evex(wstr, (1UL << 63)) == 1); assert(__wcsnlen_avx2(wstr, (1UL << 63)) == 1); } ``` Build statically so `__wcsnlen_avx2` / `__wcsnlen_evex` are defined. Output: ``` wcsnlen: wcsnlen.c:31: main: Assertion `__wcsnlen_avx2(wstr, (1UL << 63)) == 1' failed. Aborted (core dumped) ``` -- You are receiving this mail because: You are on the CC list for the bug.
next reply other threads:[~2022-09-20 22:55 UTC|newest] Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-09-20 22:55 goldstein.w.n at gmail dot com [this message] 2022-09-20 22:58 ` [Bug string/29591] " goldstein.w.n at gmail dot com 2023-03-01 16:45 ` carlos at redhat dot com 2023-03-01 16:46 ` carlos at redhat dot com
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-29591-131@http.sourceware.org/bugzilla/ \ --to=sourceware-bugzilla@sourceware.org \ --cc=glibc-bugs@sourceware.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).