From aa4bc24439a0a9aded58241dea7cf8d14bbc890c Mon Sep 17 00:00:00 2001 From: ypicchi-arm <67330153+ypicchi-arm@users.noreply.github.com> Date: Mon, 5 Aug 2024 07:42:56 +0100 Subject: [PATCH] Fix noodle SVE2 off by one bug (#309) By using svmatch on 16 bit lanes with a 8 bit predicate, we end up including an undefined character in the pattern checks. The inactive lane after load contains an undefined value, usually \0. Patterns using \0 as the last character would then match this spurious character, returning a match beyond the buffer's end. The fix checks for such matches and rejects them. Signed-off-by: Yoan Picchi --- src/hwlm/noodle_engine_sve.hpp | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/hwlm/noodle_engine_sve.hpp b/src/hwlm/noodle_engine_sve.hpp index cc2d7700..24e0ae2a 100644 --- a/src/hwlm/noodle_engine_sve.hpp +++ b/src/hwlm/noodle_engine_sve.hpp @@ -38,8 +38,12 @@ hwlm_error_t checkMatched(const struct noodTable *n, const u8 *buf, size_t len, size_t matchPos = basePos + svcntp_b8(svptrue_b8(), brk); DEBUG_PRINTF("match pos %zu\n", matchPos); assert(matchPos < len); - hwlmcb_rv_t rv = final(n, buf, len, needsConfirm, cbi, matchPos); - RETURN_IF_TERMINATED(rv); + size_t end_of_match_pos = matchPos - cbi->offsetAdj + n->key_offset - 1; + // doubleMatched can add a fake \0 at the end of the buffer. This check get rid of any match that might include it + if(end_of_match_pos < len) { + hwlmcb_rv_t rv = final(n, buf, len, needsConfirm, cbi, matchPos); + RETURN_IF_TERMINATED(rv); + } next_match = svpnext_b8(matched, next_match); } while (unlikely(svptest_any(svptrue_b8(), next_match))); return HWLM_SUCCESS; @@ -155,6 +159,9 @@ svbool_t doubleMatched(svuint16_t chars, const u8 *d, // d - 1 won't underflow as the first position in buf has been dealt // with meaning that d > buf svuint16_t vec_rot = svreinterpret_u16(svld1_u8(pg_rot, d - 1)); + // we reuse u8 predicates for u16 lanes. This means that we may actually check against one + // undefined extra character at the end of the buffer (usually \0). We check it later to + // reject this spurious match *matched = svmatch(pg, vec, chars); *matched_rot = svmatch(pg_rot, vec_rot, chars); return svorr_z(svptrue_b8(), *matched, *matched_rot);