memchr overshoots on ia64

diff --git a/ChangeLog b/ChangeLog
index a5797eaf8868faa30f606da60c082d36d5d7cfbe..a68be8002d63c0b67d5373740321b284096964cc 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2010-02-05  H.J. Lu  <hongjiu.lu@intel.com>
+
+       [BZ #11230]
+       * sysdeps/ia64/memchr.S: Don't read beyond the last byte
+       during recovery.
+
 2010-01-26  Andreas Schwab  <schwab@redhat.com>
 
        * sysdeps/unix/sysv/linux/s390/s390-32/utmp32.c: Use internal

diff --git a/sysdeps/ia64/memchr.S b/sysdeps/ia64/memchr.S
index cdd71ca5a5a59d035a786f0534005d97bcb04eb2..56d80568395915dfaed2a1f3383032a4123f3434 100644 (file)
--- a/sysdeps/ia64/memchr.S
+++ b/sysdeps/ia64/memchr.S
@@ -47,7 +47,7 @@
 #define saved_lc       r16
 #define        chr             r17
 #define len            r18
-#define pos0           r20
+#define last           r20
 #define val            r21
 #define tmp            r24
 #define chrx8          r25
@@ -67,6 +67,7 @@ ENTRY(__memchr)
        mov     saved_pr = pr           // save the predicates
        .body
        mov     ret0 = str
+       add     last = str, in2         // last byte
        and     tmp = 7, str            // tmp = str % 8
        cmp.ne  p7, p0 = r0, r0         // clear p7
        extr.u  chr = in1, 0, 8         // chr = (unsigned char) in1
@@ -143,7 +144,10 @@ ENTRY(__memchr)
        ld8     tmp = [ret0];;          // load the first unchecked 8byte
        xor     aux[1] = tmp, chrx8;;
        czx1.r  poschr[1] = aux[1];;
-       cmp.ne  p7, p0 = 8, poschr[1]
+       cmp.ne  p7, p0 = 8, poschr[1];;
+(p7)   add     ret0 = addr[MEMLAT+2], poschr[1];;
+(p7)   cmp.geu p6, p7 = ret0, last     // don't go over the last byte
+(p6)   br.cond.spnt    .notfound;;
 (p7)   br.cond.spnt    .foundit;;
        adds    ret0 = 8, ret0          // load the next unchecked 8byte
        br.sptk .l4;;