[PATCH] riscv: fix integer wraparound in memcpy

[PATCH] riscv: fix integer wraparound in memcpy

[PkmX]

This patch fixes a bug in RISC-V's memcpy implementation where an
integer wraparound occurs when src + size < 8 * sizeof(long), causing
the word-sized copy loop to be incorrectly entered.

Signed-off-by: Chih-Mao Chen <cmchen@andestech.com>
---
 newlib/libc/machine/riscv/memcpy.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/newlib/libc/machine/riscv/memcpy.c
b/newlib/libc/machine/riscv/memcpy.c
index 07e8e0076..4098f3ab1 100644
--- a/newlib/libc/machine/riscv/memcpy.c
+++ b/newlib/libc/machine/riscv/memcpy.c
@@ -51,9 +51,9 @@ small:
   const long *lb = (const long *)b;
   long *lend = (long *)((uintptr_t)end & ~msk);

-  if (unlikely (la < (lend - 8)))
+  if (unlikely (lend - la > 8))
     {
-      while (la < (lend - 8))
+      while (lend - la > 8)
        {
          long b0 = *lb++;
          long b1 = *lb++;
-- 
2.27.0

Re: [PATCH] riscv: fix integer wraparound in memcpy

[Corinna Vinschen]

Hi Chen,

On Jul 24 19:07, PkmX via Newlib wrote:
> This patch fixes a bug in RISC-V's memcpy implementation where an
> integer wraparound occurs when src + size < 8 * sizeof(long), causing
> the word-sized copy loop to be incorrectly entered.
> 
> Signed-off-by: Chih-Mao Chen <cmchen@andestech.com>
> ---
>  newlib/libc/machine/riscv/memcpy.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/newlib/libc/machine/riscv/memcpy.c
> b/newlib/libc/machine/riscv/memcpy.c
> index 07e8e0076..4098f3ab1 100644
> --- a/newlib/libc/machine/riscv/memcpy.c
> +++ b/newlib/libc/machine/riscv/memcpy.c
> @@ -51,9 +51,9 @@ small:
>    const long *lb = (const long *)b;
>    long *lend = (long *)((uintptr_t)end & ~msk);
> 
> -  if (unlikely (la < (lend - 8)))
> +  if (unlikely (lend - la > 8))
>      {
> -      while (la < (lend - 8))
> +      while (lend - la > 8)
>         {
>           long b0 = *lb++;
>           long b1 = *lb++;
> -- 
> 2.27.0

I pushed this, but I had to fix your patch because your MUA broke
the layout (line breaks, white spaces).

Would you mind to check your MUA settings or send the patch as
attachment next time?


Thanks,
Corinna

-- 
Corinna Vinschen
Cygwin Maintainer
Red Hat

Re: [PATCH] riscv: fix integer wraparound in memcpy

[Kito Cheng]

Hi Chih-Mao:

Thanks for your patch :)

Hi Corinna:

Thanks!

On Mon, Jul 27, 2020 at 4:22 PM Corinna Vinschen via Newlib
<newlib@sourceware.org> wrote:
>
> Hi Chen,
>
> On Jul 24 19:07, PkmX via Newlib wrote:
> > This patch fixes a bug in RISC-V's memcpy implementation where an
> > integer wraparound occurs when src + size < 8 * sizeof(long), causing
> > the word-sized copy loop to be incorrectly entered.
> >
> > Signed-off-by: Chih-Mao Chen <cmchen@andestech.com>
> > ---
> >  newlib/libc/machine/riscv/memcpy.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/newlib/libc/machine/riscv/memcpy.c
> > b/newlib/libc/machine/riscv/memcpy.c
> > index 07e8e0076..4098f3ab1 100644
> > --- a/newlib/libc/machine/riscv/memcpy.c
> > +++ b/newlib/libc/machine/riscv/memcpy.c
> > @@ -51,9 +51,9 @@ small:
> >    const long *lb = (const long *)b;
> >    long *lend = (long *)((uintptr_t)end & ~msk);
> >
> > -  if (unlikely (la < (lend - 8)))
> > +  if (unlikely (lend - la > 8))
> >      {
> > -      while (la < (lend - 8))
> > +      while (lend - la > 8)
> >         {
> >           long b0 = *lb++;
> >           long b1 = *lb++;
> > --
> > 2.27.0
>
> I pushed this, but I had to fix your patch because your MUA broke
> the layout (line breaks, white spaces).
>
> Would you mind to check your MUA settings or send the patch as
> attachment next time?
>
>
> Thanks,
> Corinna
>
> --
> Corinna Vinschen
> Cygwin Maintainer
> Red Hat
>