[Bug target/94158] Expanded strlen causes out-of-bounds read on AMD64 target

parker@cyber-itl.org gcc-bugzilla@gcc.gnu.org
Thu Mar 12 21:59:34 GMT 2020


https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94158

--- Comment #3 from Parker Thompson <parker@cyber-itl.org> ---
(In reply to Andrew Pinski from comment #2)
> Also aligned_alloc normally does not allow alignment of 1.
> 
> So GCC is doing the correct thing.

The replacement of strdup here is just to illustrate the issue with expansion
alignment of strlen() by forcing a crash.

I encountered this issue when working with a custom malloc replacement that
would enforce out-of-bounds read checks. Using the same reproduction with clang
did not produce a crash / oob-read.

As for alloc alignment, glibc strdup() does not use aligned_alloc, just malloc.
 Which by my read of the spec does not guarantee alignment.


More information about the Gcc-bugs mailing list