From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-lj1-x242.google.com (mail-lj1-x242.google.com [IPv6:2a00:1450:4864:20::242]) by sourceware.org (Postfix) with ESMTPS id 7CFC9389040E for ; Fri, 24 Jul 2020 11:08:23 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 7CFC9389040E Received: by mail-lj1-x242.google.com with SMTP id h22so9556648lji.9 for ; Fri, 24 Jul 2020 04:08:23 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=1a0qFY1HNEZ1CB3+SseyvjgoGIIDxWLy7KWNh+gtgV8=; b=Z1nRSS/diRlKT80xSQsBAK0DjHTiA9eiEnlzIJO/qfIHASTfcgQX9upeEXKg0n+/4x CW9XpbAKXTxH4ps0kBY5dPbvi32kiWuVhf4wssAuiM7R3gqVu+YdsDQH0R5+0eK1rWy9 fySETcShy5M9KT+1aSri1ANP/gAX35m34kJVhM+ZDJfb23MfnkCxWE2ECKzLLyYeTK7U 7i52oKNjN4pXGdw+gTzpBaexcZFI9UCnVfuThVowJUmfbjzbjgUo3YlFf3UTtBWqAQPv 4QtOlE7v7pQ0sUturJrpGAYEnjeRVEI+e5lLtqOm4//m+wQPculeHsCFKwB5UvelooSY OShg== X-Gm-Message-State: AOAM5312AeetSs1SzJx6wBR/1Yh1tauvrmGyabW9xUp0kKlUP9oDPnvR UawahyfRYjXi1x9Q/AztmJigynV6lI5Novz2Tzm8Jb8= X-Google-Smtp-Source: ABdhPJxgUgAjsBdyTRnje8bAMmGP+NEBhlNn28wH5Lk7aXPljvZlRMVoMTKW6hpudttRCO14O3KPNYRUpV3t4+zgvMM= X-Received: by 2002:a2e:864b:: with SMTP id i11mr4010100ljj.64.1595588901885; Fri, 24 Jul 2020 04:08:21 -0700 (PDT) MIME-Version: 1.0 From: PkmX Date: Fri, 24 Jul 2020 19:07:45 +0800 Message-ID: Subject: [PATCH] riscv: fix integer wraparound in memcpy To: newlib@sourceware.org Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-8.8 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: newlib@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Newlib mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2020 11:08:24 -0000 This patch fixes a bug in RISC-V's memcpy implementation where an integer wraparound occurs when src + size < 8 * sizeof(long), causing the word-sized copy loop to be incorrectly entered. Signed-off-by: Chih-Mao Chen --- newlib/libc/machine/riscv/memcpy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/newlib/libc/machine/riscv/memcpy.c b/newlib/libc/machine/riscv/memcpy.c index 07e8e0076..4098f3ab1 100644 --- a/newlib/libc/machine/riscv/memcpy.c +++ b/newlib/libc/machine/riscv/memcpy.c @@ -51,9 +51,9 @@ small: const long *lb = (const long *)b; long *lend = (long *)((uintptr_t)end & ~msk); - if (unlikely (la < (lend - 8))) + if (unlikely (lend - la > 8)) { - while (la < (lend - 8)) + while (lend - la > 8) { long b0 = *lb++; long b1 = *lb++; -- 2.27.0