diff options
| author | ienkovich <ienkovich@138bc75d-0d04-0410-961f-82ee72b054a4> | 2016-06-10 09:31:37 +0000 |
|---|---|---|
| committer | ienkovich <ienkovich@138bc75d-0d04-0410-961f-82ee72b054a4> | 2016-06-10 09:31:37 +0000 |
| commit | 27526742a57a89c3fb11075b45359bf10d287603 (patch) | |
| tree | e60ed20e95b1ddc374c43c5f17637a5a8c67023c /libmpx | |
| parent | 1683bde959019473688756d052f254992b908145 (diff) | |
| download | gcc-27526742a57a89c3fb11075b45359bf10d287603.tar.gz | |
libmpx/
2016-06-10 Ilya Enkovich <ilya.enkovich@intel.com>
Backport from mainline r237292.
2016-06-10 Ilya Enkovich <ilya.enkovich@intel.com>
* mpxwrap/mpx_wrappers.c (move_bounds): Fix overflow bug.
git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/branches/gcc-6-branch@237293 138bc75d-0d04-0410-961f-82ee72b054a4
Diffstat (limited to 'libmpx')
| -rw-r--r-- | libmpx/ChangeLog | 7 | ||||
| -rw-r--r-- | libmpx/mpxwrap/mpx_wrappers.c | 12 |
2 files changed, 18 insertions, 1 deletions
diff --git a/libmpx/ChangeLog b/libmpx/ChangeLog index 47146d1cf7c..98bb5577de3 100644 --- a/libmpx/ChangeLog +++ b/libmpx/ChangeLog @@ -1,3 +1,10 @@ +2016-06-10 Ilya Enkovich <ilya.enkovich@intel.com> + + Backport from mainline r237292. + 2016-06-10 Ilya Enkovich <ilya.enkovich@intel.com> + + * mpxwrap/mpx_wrappers.c (move_bounds): Fix overflow bug. + 2016-04-27 Release Manager * GCC 6.1.0 released. diff --git a/libmpx/mpxwrap/mpx_wrappers.c b/libmpx/mpxwrap/mpx_wrappers.c index d4c83ef484c..171a780311d 100644 --- a/libmpx/mpxwrap/mpx_wrappers.c +++ b/libmpx/mpxwrap/mpx_wrappers.c @@ -27,6 +27,7 @@ #include "string.h" #include <sys/mman.h> #include <stdint.h> +#include <assert.h> #include "mpxrt/mpxrt.h" void * @@ -418,7 +419,16 @@ move_bounds (void *dst, const void *src, size_t n) else elems_to_copy -= src_bt_index_end + 1; } - src_bd_index_end--; + /* Go to previous table but beware of overflow. + We should have copied all required element + in case src_bd_index_end is 0. */ + if (src_bd_index_end) + src_bd_index_end--; + else + { + assert (!elems_to_copy); + return; + } /* For each bounds table we check if there are valid pointers inside. If there are some, we copy table in pre-counted portions. */ for (; src_bd_index_end > src_bd_index; src_bd_index_end--) |