From: Ilya Enkovich <ilya.enkovich@intel.com>
Date: Fri, 10 Jun 2016 09:23:53 +0000 (+0000)
Subject: mpx_wrappers.c (move_bounds): Fix overflow bug.
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=2cfab6c0f78dbb079737861ab7346420642d1b47;p=gcc.git

mpx_wrappers.c (move_bounds): Fix overflow bug.

libmpx/

2016-06-10  Ilya Enkovich  <ilya.enkovich@intel.com>

	* mpxwrap/mpx_wrappers.c (move_bounds): Fix overflow bug.

From-SVN: r237292
---

diff --git a/libmpx/ChangeLog b/libmpx/ChangeLog
index 4d5858122dc..636e9651364 100644
--- a/libmpx/ChangeLog
+++ b/libmpx/ChangeLog
@@ -1,3 +1,7 @@
+2016-06-10  Ilya Enkovich  <ilya.enkovich@intel.com>
+
+	* mpxwrap/mpx_wrappers.c (move_bounds): Fix overflow bug.
+
 2016-01-20  Matthias Klose  <doko@ubuntu.com>
 
         * libtool-version: Remove.
diff --git a/libmpx/mpxwrap/mpx_wrappers.c b/libmpx/mpxwrap/mpx_wrappers.c
index d4c83ef484c..171a780311d 100644
--- a/libmpx/mpxwrap/mpx_wrappers.c
+++ b/libmpx/mpxwrap/mpx_wrappers.c
@@ -27,6 +27,7 @@
 #include "string.h"
 #include <sys/mman.h>
 #include <stdint.h>
+#include <assert.h>
 #include "mpxrt/mpxrt.h"
 
 void *
@@ -418,7 +419,16 @@ move_bounds (void *dst, const void *src, size_t n)
           else
             elems_to_copy -= src_bt_index_end + 1;
         }
-      src_bd_index_end--;
+      /* Go to previous table but beware of overflow.
+	 We should have copied all required element
+	 in case src_bd_index_end is 0.  */
+      if (src_bd_index_end)
+	src_bd_index_end--;
+      else
+	{
+	  assert (!elems_to_copy);
+	  return;
+	}
       /* For each bounds table we check if there are valid pointers inside.
          If there are some, we copy table in pre-counted portions.  */
       for (; src_bd_index_end > src_bd_index; src_bd_index_end--)