From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-74.mimecast.com (us-smtp-delivery-74.mimecast.com [63.128.21.74]) by sourceware.org (Postfix) with ESMTP id 32DB5385E82C for ; Mon, 16 Mar 2020 17:03:13 +0000 (GMT) Received: from mail-io1-f69.google.com (mail-io1-f69.google.com [209.85.166.69]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-308-rOVydacDP46FvsbuyxBjWw-1; Mon, 16 Mar 2020 13:03:05 -0400 X-MC-Unique: rOVydacDP46FvsbuyxBjWw-1 Received: by mail-io1-f69.google.com with SMTP id z207so9913872iof.7 for ; Mon, 16 Mar 2020 10:03:05 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=sBZ86VtQ1hiHOms8vUUfegfCYVa5GVudI422Va+MZQ0=; b=fBtEkGGE/6kiZhmw+x8eJ6lNIMULhBwFGaj39PCSzCIgenYDkrGT9IenMqAEB/zdE6 NeIpnzV8EUBzrhNJLCvGPps6K7f/0Ti4QDSenH6RaeWOLxONTIHreV9ygHcCgPOsP58q f225hC9Sh20C9ASIbIwMBUs2o33gcGDCeoYspbifMTWqcuF2SRAwTvSk7p1GDQ7PWxSu +AtoXfxjWkRJeS/uOSONO61UKuLeQQ3YbOljqf/KT/8twJFdjdfdZCyqSz0yIOGWBL/P yhYguYQxGo1vUf/hbVAl5ooL6CXMrtkRTLPlZUQIlqDsqqVTEV4/PHYrIxPLL9J0CwNO Il3Q== X-Gm-Message-State: ANhLgQ2pv4fXx/6BKFn7anBSF/fA8dMuCvT8ZDig9tB7luB5nowk2Cw8 y6X4O7lz9CKRhVaTx53ybl9l5n473UexUys8D/Ntq1+BMhGBMMJ5vxNMlTAVb7Oo3nMkZx7XEQo LkIsjopfztOTF1uZaCMEQz0EgGKwbRQ2TSE+DxQ== X-Received: by 2002:a6b:8f11:: with SMTP id r17mr144866iod.92.1584378184193; Mon, 16 Mar 2020 10:03:04 -0700 (PDT) X-Google-Smtp-Source: ADFU+vsPHGyOS4OwrD32Mjx3axBMk7CXk/UDkgHCKPWZZdRdqBCMzt1Hcb1Taz+1r6R2wdn4KFqXbqUW9pFwKIB9ois= X-Received: by 2002:a6b:8f11:: with SMTP id r17mr144830iod.92.1584378183704; Mon, 16 Mar 2020 10:03:03 -0700 (PDT) MIME-Version: 1.0 From: Patsy Griffin Date: Mon, 16 Mar 2020 13:02:27 -0400 Message-ID: Subject: [2.29 COMMITED 1/2] Avoid ldbl-96 stack corruption from range reduction of pseudo-zero (bug 25487). To: libc-stable@sourceware.org X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-25.2 required=5.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, HTML_MESSAGE, KAM_SHORT, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.29 X-BeenThere: libc-stable@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-stable mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Mar 2020 17:03:15 -0000 From: Joseph Myers Bug 25487 reports stack corruption in ldbl-96 sinl on a pseudo-zero argument (an representation where all the significand bits, including the explicit high bit, are zero, but the exponent is not zero, which is not a valid representation for the long double type). Although this is not a valid long double representation, existing practice in this area (see bug 4586, originally marked invalid but subsequently fixed) is that we still seek to avoid invalid memory accesses as a result, in case of programs that treat arbitrary binary data as long double representations, although the invalid representations of the ldbl-96 format do not need to be consistently handled the same as any particular valid representation. This patch makes the range reduction detect pseudo-zero and unnormal representations that would otherwise go to __kernel_rem_pio2, and returns a NaN for them instead of continuing with the range reduction process. (Pseudo-zero and unnormal representations whose unbiased exponent is less than -1 have already been safely returned from the function before this point without going through the rest of range reduction.) Pseudo-zero representations would previously result in the value passed to __kernel_rem_pio2 being all-zero, which is definitely unsafe; unnormal representations would previously result in a value passed whose high bit is zero, which might well be unsafe since that is not a form of input expected by __kernel_rem_pio2. Tested for x86_64. (cherry picked from commit 9333498794cde1d5cca518badf79533a24114b6f) --- sysdeps/ieee754/ldbl-96/Makefile | 3 +- sysdeps/ieee754/ldbl-96/e_rem_pio2l.c | 12 +++++++ sysdeps/ieee754/ldbl-96/test-sinl-pseudo.c | 41 ++++++++++++++++++++++ 3 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 sysdeps/ieee754/ldbl-96/test-sinl-pseudo.c diff --git a/sysdeps/ieee754/ldbl-96/Makefile b/sysdeps/ieee754/ldbl-96/Makefile index b103254214..052c1c7703 100644 --- a/sysdeps/ieee754/ldbl-96/Makefile +++ b/sysdeps/ieee754/ldbl-96/Makefile @@ -17,5 +17,6 @@ # . ifeq ($(subdir),math) -tests +=3D test-canonical-ldbl-96 test-totalorderl-ldbl-96 +tests +=3D test-canonical-ldbl-96 test-totalorderl-ldbl-96 test-sinl-pseud= o +CFLAGS-test-sinl-pseudo.c +=3D -fstack-protector-all endif diff --git a/sysdeps/ieee754/ldbl-96/e_rem_pio2l.c b/sysdeps/ieee754/ldbl-96/e_rem_pio2l.c index 805de22d73..1aeccb47d7 100644 --- a/sysdeps/ieee754/ldbl-96/e_rem_pio2l.c +++ b/sysdeps/ieee754/ldbl-96/e_rem_pio2l.c @@ -210,6 +210,18 @@ __ieee754_rem_pio2l (long double x, long double *y) return 0; } + if ((i0 & 0x80000000) =3D=3D 0) + { + /* Pseudo-zero and unnormal representations are not valid + representations of long double. We need to avoid stack + corruption in __kernel_rem_pio2, which expects input in a + particular normal form, but those representations do not need + to be consistently handled like any particular floating-point + value. */ + y[1] =3D y[0] =3D __builtin_nanl (""); + return 0; + } + /* Split the 64 bits of the mantissa into three 24-bit integers stored in a double array. */ exp =3D j0 - 23; diff --git a/sysdeps/ieee754/ldbl-96/test-sinl-pseudo.c b/sysdeps/ieee754/ldbl-96/test-sinl-pseudo.c new file mode 100644 index 0000000000..f59b97769d --- /dev/null +++ b/sysdeps/ieee754/ldbl-96/test-sinl-pseudo.c @@ -0,0 +1,41 @@ +/* Test sinl for pseudo-zeros and unnormals for ldbl-96 (bug 25487). + Copyright (C) 2020 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include + +static int +do_test (void) +{ + for (int i =3D 0; i < 64; i++) + { + uint64_t sig =3D i =3D=3D 63 ? 0 : 1ULL << i; + long double ld; + SET_LDOUBLE_WORDS (ld, 0x4141, + sig >> 32, sig & 0xffffffffULL); + /* The requirement is that no stack overflow occurs when the + pseudo-zero or unnormal goes through range reduction. */ + volatile long double ldr; + ldr =3D sinl (ld); + (void) ldr; + } + return 0; +} + +#include -- 2.17.2