• Christopher Ferris's avatar
    Fix over read in strcpy/stpcpy/strcat. · fdfcfce7
    Christopher Ferris authored
    This bug will happen when these circumstances are met:
    
    - Destination address & 0x7 == 1, strlen of src is 11, 12, 13.
    - Destination address & 0x7 == 2, strlen of src is 10, 11, 12.
    - Destination address & 0x7 == 3, strlen of src is 9, 10, 11.
    - Destination address & 0x7 == 4, strlen of src is 8, 9, 10.
    
    In these cases, the dest alignment code does a ldr which reads 4 bytes,
    and it will read past the end of the source. In most cases, this is
    probably benign, but if this crosses into a new page it could cause a
    crash.
    
    Fix the labels in the cortex-a9 strcat.
    
    Modify the overread test to vary the dst alignment to expost this bug.
    Also, shrink the strcat/strlcat overread cases since the dst alignment
    variation increases the runtime too much.
    
    Bug: 24345899
    Change-Id: Ib34a559bfcebd89861985b29cae6c1e47b5b5855
    fdfcfce7
buffer_tests.cpp 11.9 KB