From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) by sourceware.org (Postfix) with ESMTP id DA6933858D35 for ; Mon, 27 Jul 2020 08:15:19 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org DA6933858D35 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-194-EBzITbbvPxiAFcaTs36TBQ-1; Mon, 27 Jul 2020 04:15:17 -0400 X-MC-Unique: EBzITbbvPxiAFcaTs36TBQ-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 9C3B28014D4; Mon, 27 Jul 2020 08:15:16 +0000 (UTC) Received: from calimero.vinschen.de (ovpn-112-68.ams2.redhat.com [10.36.112.68]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 6E9E37010B; Mon, 27 Jul 2020 08:15:16 +0000 (UTC) Received: by calimero.vinschen.de (Postfix, from userid 500) id 07673A8096F; Mon, 27 Jul 2020 10:15:15 +0200 (CEST) Date: Mon, 27 Jul 2020 10:15:14 +0200 From: Corinna Vinschen To: PkmX Cc: newlib@sourceware.org Subject: Re: [PATCH] riscv: fix integer wraparound in memcpy Message-ID: <20200727081514.GD4206@calimero.vinschen.de> Reply-To: newlib@sourceware.org Mail-Followup-To: PkmX , newlib@sourceware.org References: MIME-Version: 1.0 In-Reply-To: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Disposition: inline X-Spam-Status: No, score=-13.0 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: newlib@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Newlib mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2020 08:15:20 -0000 Hi Chen, On Jul 24 19:07, PkmX via Newlib wrote: > This patch fixes a bug in RISC-V's memcpy implementation where an > integer wraparound occurs when src + size < 8 * sizeof(long), causing > the word-sized copy loop to be incorrectly entered. > > Signed-off-by: Chih-Mao Chen > --- > newlib/libc/machine/riscv/memcpy.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/newlib/libc/machine/riscv/memcpy.c > b/newlib/libc/machine/riscv/memcpy.c > index 07e8e0076..4098f3ab1 100644 > --- a/newlib/libc/machine/riscv/memcpy.c > +++ b/newlib/libc/machine/riscv/memcpy.c > @@ -51,9 +51,9 @@ small: > const long *lb = (const long *)b; > long *lend = (long *)((uintptr_t)end & ~msk); > > - if (unlikely (la < (lend - 8))) > + if (unlikely (lend - la > 8)) > { > - while (la < (lend - 8)) > + while (lend - la > 8) > { > long b0 = *lb++; > long b1 = *lb++; > -- > 2.27.0 I pushed this, but I had to fix your patch because your MUA broke the layout (line breaks, white spaces). Would you mind to check your MUA settings or send the patch as attachment next time? Thanks, Corinna -- Corinna Vinschen Cygwin Maintainer Red Hat