Fix possible misaligned read in crc32c algorithm #688
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It is possible to have a misaligned pointer read for certain input buffers to the crc32c algorithm. The bug comes from the usage of
crc32c8s
incrc32cSse64bit
.crc32cSse64bit
attempts to calculate the crc32c code by consuming the input buffer 1024 bytes at a time. It does so by calculating how much of the initial input it needs to read until the remaining input buffer is divisible by 1024.The problem is the assumption that consuming
i
bytes will keep you on an 8-byte aligned boundary. This is important, becausecrc32c1024SseInt
requires that the input buffer passed to it is aligned onuint64_t*
.As an example, imagine the case where we pass a buffer of size 1025, initially aligned on a 8 bytes.
Because we first try to process the first
1025 % 1024 = 1
bytes, we end up passing address 0x001 tocrc32c1024SseInt
to try and compute the final chunk of 1024.We fix this by swapping the order in which we process the buffer, by first processing up to the next 8-byte aligned boundary and then process as many 1024-byte chunks as we can, then finish consuming the rest with
crc32c8s
.