Skip to content

Commit b41ea8e

Browse files
committed
[libc][bug] Fix out of bound write in memcpy wi software prefetching
This bug showed up when running fuzzers newly added fuzzers llvm#90591.
1 parent d72146f commit b41ea8e

File tree

1 file changed

+13
-1
lines changed

1 file changed

+13
-1
lines changed

libc/src/string/memory_utils/x86_64/inline_memcpy.h

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,13 @@ inline_memcpy_x86_sse2_ge64_sw_prefetching(Ptr __restrict dst,
107107
offset += K_THREE_CACHELINES;
108108
}
109109
}
110-
return builtin::Memcpy<32>::loop_and_tail_offset(dst, src, count, offset);
110+
// We don't use 'loop_and_tail_offset' because it assumes at least one
111+
// iteration of the loop.
112+
while (offset + 32 <= count) {
113+
builtin::Memcpy<32>::block_offset(dst, src, offset);
114+
offset += 32;
115+
}
116+
return builtin::Memcpy<32>::tail(dst, src, count);
111117
}
112118

113119
[[maybe_unused]] LIBC_INLINE void
@@ -140,6 +146,12 @@ inline_memcpy_x86_avx_ge64_sw_prefetching(Ptr __restrict dst,
140146
offset += K_THREE_CACHELINES;
141147
}
142148
return builtin::Memcpy<64>::loop_and_tail_offset(dst, src, count, offset);
149+
// We don't use 'loop_and_tail_offset' because it assumes at least one
150+
// iteration of the loop.
151+
while (offset + 64 <= count) {
152+
builtin::Memcpy<64>::block_offset(dst, src, offset);
153+
offset += 64;
154+
}
143155
}
144156

145157
[[maybe_unused]] LIBC_INLINE void

0 commit comments

Comments
 (0)