[Bug string/34294] New: test-memchr: page-cross test violating the caller's memchr contract

https://sourceware.org/bugzilla/show_bug.cgi?id=34294

            Bug ID: 34294
           Summary: test-memchr: page-cross test violating the caller's
                    memchr contract
           Product: glibc
           Version: 2.44
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: string
          Assignee: unassigned at sourceware dot org
          Reporter: sajan.karumanchi at amd dot com
  Target Milestone: ---

Commit 746a560a6296 ("string: Improve test-memchr page cross checks")
added a new test case in string/test-memchr.c (lines 260-262) that
violates the caller-side contract of the memchr() function as defined
by the C11 standard and POSIX.

The standard requires the CALLER to guarantee that n bytes starting from
s are accessible. The implementation is entitled to read any or all of
those n bytes, in any order. There is no requirement in the standard
that memchr must stop reading once a match is found.

The new test positions the buffer near a PROT_NONE guard page such that only a
small number of bytes are actually accessible, yet passes n=1024 to memchr.
This means the test promises memchr that 1024 bytes are readable when, in
reality, far fewer are. This constitutes undefined behavior on the caller's
part.

As a result, any conforming memchr implementation that performs read-ahead with
unaligned loads using SIMD to process 16/32/64-byte chunks, or prefetching
beyond the match position but within the n-byte range would legitimately
segfault with this test.

-- 
You are receiving this mail because:
You are on the CC list for the bug.