linux-mips
[Top] [All Lists]

Bug in memmove

To: linux-mips@oss.sgi.com
Subject: Bug in memmove
From: "Gleb O. Raiko" <raiko@niisi.msk.ru>
Date: Wed, 06 Jun 2001 17:11:19 +0400
Organization: NIISI RAN
Sender: owner-linux-mips@oss.sgi.com
Hello,

It seems there is a bug in our memmove routine. The condition is rare
though, for example, memmove copies incorrectly, if src=5, dst=4, len=9.
I guess, exact condition is:

len > 8, 0 < src - dst < 8, src isn't aligned on qw (8 bytes), src - dst
!= 4

I may be wrong on exact condition, but at least the example works.

Briefly, memmove calls memcpy if src > dst. Then, when memcpy aligns src
on qw, it copies qw to dst. So, after src is aligned, it is overwritten
as well. In the example, memcpy copies qw at 4 (so, new data ends on
4+8=12), but aligned src is at address 8, so a word at address 8 is
overwritten.

Two questions here. First, do we have a pattern that satisfies the
condition, i.e. is the bug showstopper? My guess, it's not. Second, does
somebody have ideas how to fix the bug? Well, I have, but want to hear
somebody else.

Regards,
Gleb.

<Prev in Thread] Current Thread [Next in Thread>