From: Icenowy Zheng <uwu@icenowy.me>
Date: Mon, 24 Mar 2025 08:50:37 +0000 (+0800)
Subject: riscv: chunkset_rvv: fix SIGSEGV in CHUNKCOPY
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=28cff70e5635c124944780ac84d633e64b0cb4d2;p=thirdparty%2Fzlib-ng.git

riscv: chunkset_rvv: fix SIGSEGV in CHUNKCOPY

The chunkset_tpl comment allows negative dist (out - from) as long as
the length is smaller than the absolute value of dist (i.e. memory does
not overlap). However this case is currently broken in the RVV override
of CHUNKCOPY -- it compares dist (which is a ptrdiff_t, a value that
should be of the same size with size_t but signed) with the result of
sizeof (which is a size_t), and this triggers the implicit conversion
from signed to unsigned (thus losing negative values).

As it's promised to be not overlapping when dist is negative, just use a
gaint memcpy() call to copy everything.

Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
---

diff --git a/arch/riscv/chunkset_rvv.c b/arch/riscv/chunkset_rvv.c
index ee43bde2..e0915dfc 100644
--- a/arch/riscv/chunkset_rvv.c
+++ b/arch/riscv/chunkset_rvv.c
@@ -92,7 +92,7 @@ static inline uint8_t* CHUNKCOPY(uint8_t *out, uint8_t const *from, unsigned len
     from += align;
     len -= align;
     ptrdiff_t dist = out - from;
-    if (dist >= len) {
+    if (dist < 0 || dist >= len) {
         memcpy(out, from, len);
         out += len;
         from += len;