Bug 486293 - memccpy false positives

(cherry picked from commit 805c020c6e5161966e6eb0099ebe937a510cea9e)

diff --git a/NEWS b/NEWS
index c40e00cce46b018c6c06692cda4f2089c5df1d27..f674191a286a8aeb02432122305a535d2b74c843 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,7 @@ Branch 3.23
 The following bugs have been fixed or resolved on this branch.
 
 486180  [MIPS] 'VexGuestArchState' has no member named 'guest_IP_AT_SYSCALL'
+486293  memccpy false positives
 
 To see details of a given bug, visit
   https://bugs.kde.org/show_bug.cgi?id=XXXXXX

diff --git a/memcheck/tests/memccpy2.c b/memcheck/tests/memccpy2.c
index a5a1dfc9f0af773a61bdf5344ca27d17da9ce0fb..947324581715a7cb52fff98f72ebe05d4182c183 100644 (file)
--- a/memcheck/tests/memccpy2.c
+++ b/memcheck/tests/memccpy2.c
@@ -1,6 +1,8 @@
 #include <ctype.h>
 #include <stdio.h>
 #include <string.h>
+#include <assert.h>
+#include <stdlib.h>
  
 int main(void)
 {
@@ -9,5 +11,23 @@ int main(void)
    memccpy(astring+10, astring, '#', len-10);
    sprintf(astring, "this is a string # with something to seek");
    memccpy(astring, astring+10, '#', len);
+   
+   sprintf(astring, "this is a string # with something to seek");
+   /*
+    * space is earlier than len, no overlap
+    * "this " gets copied (up to and including the first ' ')
+    * and it overwrites the destination starting with the 's' of "string"
+    * so res will point to the 'g' of "string"
+    */
+   char* res = memccpy(astring+10, astring, ' ', len-10);
+   assert(res && *res == 'g');
+   sprintf(astring, "this is a string # with something to seek");
+   /* length is 0, nothing copied, returns NULL */
+   res = memccpy(astring, "abcdefhhijklmnopqrstuvwxy", 'z', 0);
+   assert(NULL == res);
+   /* 'z' not found so 20 bytes copied, returns NULL */
+   res = memccpy(astring, "abcdefhhijklmnopqrstuvwxy", 'z', 20);
+   assert(NULL == res);
+   free(astring);
 }
 

diff --git a/memcheck/tests/memccpy2.stderr.exp b/memcheck/tests/memccpy2.stderr.exp
index 0132ef06c56a0f53574cdd75e3871b23c8175d97..240ce925c182a9f077d288f38a51ecb5e8b6930f 100644 (file)
--- a/memcheck/tests/memccpy2.stderr.exp
+++ b/memcheck/tests/memccpy2.stderr.exp
@@ -1,8 +1,8 @@
 Source and destination overlap in memccpy(0x........, 0x........, 31)
    at 0x........: memccpy (vg_replace_strmem.c:...)
-   by 0x........: main (memccpy2.c:9)
+   by 0x........: main (memccpy2.c:11)
 
 Source and destination overlap in memccpy(0x........, 0x........, 41)
    at 0x........: memccpy (vg_replace_strmem.c:...)
-   by 0x........: main (memccpy2.c:11)
+   by 0x........: main (memccpy2.c:13)
 

diff --git a/shared/vg_replace_strmem.c b/shared/vg_replace_strmem.c
index 737abbf67898facd622eb7f14e865e74db670d51..ae13a2a5f87a34e704e2ceec35a2c712f7248141 100644 (file)
--- a/shared/vg_replace_strmem.c
+++ b/shared/vg_replace_strmem.c
@@ -2364,9 +2364,9 @@ static inline void my_exit ( int x )
       \
       while (i-- > 0) \
          if ((*d++ = *s++) == x) { \
-            SizeT srclen = (i < len) ? i : len; \
+            SizeT srclen = len - i; \
             RECORD_COPY(srclen); \
-            if (is_overlap(dst, src, srclen, srclen)) \
+            if (is_overlap(dst, src, len, srclen)) \
                RECORD_OVERLAP_ERROR("memccpy", dst, src, len); \
             return d; \
          } \