[Bug target/94158] Expanded strlen causes out-of-bounds read on AMD64 target
parker@cyber-itl.org
gcc-bugzilla@gcc.gnu.org
Thu Mar 12 21:59:34 GMT 2020
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94158
--- Comment #3 from Parker Thompson <parker@cyber-itl.org> ---
(In reply to Andrew Pinski from comment #2)
> Also aligned_alloc normally does not allow alignment of 1.
>
> So GCC is doing the correct thing.
The replacement of strdup here is just to illustrate the issue with expansion
alignment of strlen() by forcing a crash.
I encountered this issue when working with a custom malloc replacement that
would enforce out-of-bounds read checks. Using the same reproduction with clang
did not produce a crash / oob-read.
As for alloc alignment, glibc strdup() does not use aligned_alloc, just malloc.
Which by my read of the spec does not guarantee alignment.
More information about the Gcc-bugs
mailing list