* sysdeps/i386/add_n.S: Wrap entry-point symbol in BP_SYM ().

Check bounds of arguments. 
* sysdeps/i386/addmul_1.S: Likewise. 
* sysdeps/i386/lshift.S: Likewise. 
* sysdeps/i386/mul_1.S: Likewise. 
* sysdeps/i386/rshift.S: Likewise. 
* sysdeps/i386/sub_n.S: Likewise. 
* sysdeps/i386/submul_1.S: Likewise. 
* sysdeps/i386/i586/add_n.S: Likewise. 
* sysdeps/i386/i586/addmul_1.S: Likewise. 
* sysdeps/i386/i586/lshift.S: Likewise. 
* sysdeps/i386/i586/rshift.S: Likewise. 
* sysdeps/i386/i586/sub_n.S: Likewise. 
* sysdeps/i386/i686/add_n.S: Likewise.
	* sysdeps/i386/memchr.S: Likewise.
	* sysdeps/i386/memcmp.S: Likewise.
	* sysdeps/i386/rawmemchr.S: Likewise.
	* sysdeps/i386/i586/bzero.S: Likewise.
	* sysdeps/i386/i586/memcpy.S: Likewise.
	* sysdeps/i386/i586/mempcpy.S: Likewise.
	* sysdeps/i386/i586/memset.S: Likewise.
	* sysdeps/i386/i686/bzero.S: Likewise.
	* sysdeps/i386/i686/memcpy.S: Likewise.
	* sysdeps/i386/i686/mempcpy.S: Likewise.
	* sysdeps/i386/i686/memset.S: Likewise.

	* sysdeps/i386/stpcpy.S: Likewise.
	* sysdeps/i386/stpncpy.S: Likewise.
	* sysdeps/i386/strchr.S: Likewise.
	* sysdeps/i386/strchrnul.S: Likewise.
	* sysdeps/i386/strcspn.S: Likewise.
	* sysdeps/i386/strpbrk.S: Likewise.
	* sysdeps/i386/strrchr.S: Likewise.
	* sysdeps/i386/strspn.S: Likewise.
	* sysdeps/i386/strtok.S: Likewise.
	* sysdeps/i386/strtok_r.S: Likewise.
	* sysdeps/i386/i486/strcat.S: Likewise.
	* sysdeps/i386/i486/strlen.S: Likewise.
	* sysdeps/i386/i586/strchr.S: Likewise.
	* sysdeps/i386/i586/strcpy.S: Likewise.
	* sysdeps/i386/i586/strlen.S: Likewise.
	* sysdeps/i386/i686/strcmp.S: Likewise.
	* sysdeps/i386/i686/strtok.S: Likewise.
	* sysdeps/i386/i686/strtok_r.S: Likewise.

	* sysdeps/i386/fpu/fegetenv.c: Wrap symbol names with BP_SYM ().
	* sysdeps/i386/fpu/fesetenv.c: Likewise.
	* sysdeps/i386/fpu/feupdateenv.c: Likewise.
	* sysdeps/i386/fpu/fgetexcptflg.c: Likewise.
	* sysdeps/i386/fpu/fsetexcptflg.c: Likewise.
	* sysdeps/i386/add_n.S: Wrap entry-point symbol in BP_SYM ().
	Check bounds of arguments.
	* sysdeps/i386/addmul_1.S: Likewise.
	* sysdeps/i386/lshift.S: Likewise.
	* sysdeps/i386/mul_1.S: Likewise.
	* sysdeps/i386/rshift.S: Likewise.
	* sysdeps/i386/sub_n.S: Likewise.
	* sysdeps/i386/submul_1.S: Likewise.
	* sysdeps/i386/i586/add_n.S: Likewise.
	* sysdeps/i386/i586/addmul_1.S: Likewise.
	* sysdeps/i386/i586/lshift.S: Likewise.
	* sysdeps/i386/i586/rshift.S: Likewise.
	* sysdeps/i386/i586/sub_n.S: Likewise.
	* sysdeps/i386/i686/add_n.S: Likewise.

	* sysdeps/i386/memchr.S: Likewise.
	* sysdeps/i386/memcmp.S: Likewise.
	* sysdeps/i386/rawmemchr.S: Likewise.
	* sysdeps/i386/i586/bzero.S: Likewise.
	* sysdeps/i386/i586/memcpy.S: Likewise.
	* sysdeps/i386/i586/mempcpy.S: Likewise.
	* sysdeps/i386/i586/memset.S: Likewise.
	* sysdeps/i386/i686/bzero.S: Likewise.
	* sysdeps/i386/i686/memcpy.S: Likewise.
	* sysdeps/i386/i686/mempcpy.S: Likewise.
	* sysdeps/i386/i686/memset.S: Likewise.

	* sysdeps/i386/stpcpy.S: Likewise.
	* sysdeps/i386/stpncpy.S: Likewise.
	* sysdeps/i386/strchr.S: Likewise.
	* sysdeps/i386/strchrnul.S: Likewise.
	* sysdeps/i386/strcspn.S: Likewise.
	* sysdeps/i386/strpbrk.S: Likewise.
	* sysdeps/i386/strrchr.S: Likewise.
	* sysdeps/i386/strspn.S: Likewise.
	* sysdeps/i386/strtok.S: Likewise.
	* sysdeps/i386/strtok_r.S: Likewise.
	* sysdeps/i386/i486/strcat.S: Likewise.
	* sysdeps/i386/i486/strlen.S: Likewise.
	* sysdeps/i386/i586/strchr.S: Likewise.
	* sysdeps/i386/i586/strcpy.S: Likewise.
	* sysdeps/i386/i586/strlen.S: Likewise.
	* sysdeps/i386/i686/strcmp.S: Likewise.
	* sysdeps/i386/i686/strtok.S: Likewise.
	* sysdeps/i386/i686/strtok_r.S: Likewise.

	* sysdeps/i386/fpu/fegetenv.c: Wrap symbol names with BP_SYM ().
	* sysdeps/i386/fpu/fesetenv.c: Likewise.
	* sysdeps/i386/fpu/feupdateenv.c: Likewise.
	* sysdeps/i386/fpu/fgetexcptflg.c: Likewise.
	* sysdeps/i386/fpu/fsetexcptflg.c: Likewise.

12 files changed, 84 insertions, 32 deletions

diff --git a/sysdeps/i386/i586/add_n.S b/sysdeps/i386/i586/add_n.S
index 7e30cac..6ed5055 100644
--- a/sysdeps/i386/i586/add_n.S
+++ b/sysdeps/i386/i586/add_n.S
@@ -20,6 +20,7 @@
 
 #include "sysdep.h"
 #include "asm-syntax.h"
+#include "bp-sym.h"
 #include "bp-asm.h"
 
 #define PARMS	LINKAGE+16		/* space for 4 saved regs */
@@ -29,7 +30,7 @@
 #define SIZE	S2+PTR_SIZE
 
 	.text
-ENTRY(__mpn_add_n)
+ENTRY (BP_SYM (__mpn_add_n))
 	ENTER
 
 	pushl	%edi
@@ -41,7 +42,13 @@ ENTRY(__mpn_add_n)
 	movl	S1(%esp),%esi
 	movl	S2(%esp),%ebx
 	movl	SIZE(%esp),%ecx
-
+#if __BOUNDED_POINTERS__
+	shll	$2, %ecx		/* convert limbs to bytes */
+	CHECK_BOUNDS_BOTH_WIDE (%edi, RES(%esp), %ecx)
+	CHECK_BOUNDS_BOTH_WIDE (%esi, S1(%esp), %ecx)
+	CHECK_BOUNDS_BOTH_WIDE (%ebx, S2(%esp), %ecx)
+	shrl	$2, %ecx
+#endif
 	movl	(%ebx),%ebp
 
 	decl	%ecx
@@ -127,4 +134,4 @@ L(end2):
 
 	LEAVE
 	ret
-END(__mpn_add_n)
+END (BP_SYM (__mpn_add_n))
diff --git a/sysdeps/i386/i586/addmul_1.S b/sysdeps/i386/i586/addmul_1.S
index 06cdbe1..2cc17dd 100644
--- a/sysdeps/i386/i586/addmul_1.S
+++ b/sysdeps/i386/i586/addmul_1.S
@@ -20,6 +20,7 @@
 
 #include "sysdep.h"
 #include "asm-syntax.h"
+#include "bp-sym.h"
 #include "bp-asm.h"
 
 #define PARMS	LINKAGE+16	/* space for 4 saved regs */
@@ -34,7 +35,7 @@
 #define s2_limb ebx
 
 	.text
-ENTRY(__mpn_addmul_1)
+ENTRY (BP_SYM (__mpn_addmul_1))
 	ENTER
 
 	pushl	%edi
@@ -46,7 +47,13 @@ ENTRY(__mpn_addmul_1)
 	movl	S1(%esp), %s1_ptr
 	movl	SIZE(%esp), %size
 	movl	S2LIMB(%esp), %s2_limb
-
+#if __BOUNDED_POINTERS__
+	shll	$2, %size	/* convert limbs to bytes */
+	CHECK_BOUNDS_BOTH_WIDE (%res_ptr, RES(%esp), %size)
+	CHECK_BOUNDS_BOTH_WIDE (%s1_ptr, S1(%esp), %size)
+	CHECK_BOUNDS_BOTH_WIDE (%s2_limb, S2LIMB(%esp), %size)
+	shrl	$2, %size
+#endif
 	leal	(%res_ptr,%size,4), %res_ptr
 	leal	(%s1_ptr,%size,4), %s1_ptr
 	negl	%size
@@ -80,4 +87,4 @@ L(oop):	adcl	$0, %ebp
 	LEAVE
 	ret
 #undef size
-END(__mpn_addmul_1)
+END (BP_SYM (__mpn_addmul_1))
diff --git a/sysdeps/i386/i586/bzero.S b/sysdeps/i386/i586/bzero.S
index 84d2f70..220aa47 100644
--- a/sysdeps/i386/i586/bzero.S
+++ b/sysdeps/i386/i586/bzero.S
@@ -1,3 +1,3 @@
 #define memset __bzero
 #include <sysdeps/i386/i586/memset.S>
-weak_alias (__bzero, bzero)
+weak_alias (BP_SYM (__bzero), BP_SYM (bzero))
diff --git a/sysdeps/i386/i586/lshift.S b/sysdeps/i386/i586/lshift.S
index 2a44150..5d753b0 100644
--- a/sysdeps/i386/i586/lshift.S
+++ b/sysdeps/i386/i586/lshift.S
@@ -19,6 +19,7 @@
 
 #include "sysdep.h"
 #include "asm-syntax.h"
+#include "bp-sym.h"
 #include "bp-asm.h"
 
 #define PARMS	LINKAGE+16		/* space for 4 saved regs */
@@ -28,7 +29,7 @@
 #define CNT	SIZE+4
 
 	.text
-ENTRY(__mpn_lshift)
+ENTRY (BP_SYM (__mpn_lshift))
 	ENTER
 
 	pushl	%edi
@@ -40,6 +41,12 @@ ENTRY(__mpn_lshift)
 	movl	S(%esp),%esi
 	movl	SIZE(%esp),%ebx
 	movl	CNT(%esp),%ecx
+#if __BOUNDED_POINTERS__
+	shll	$2, %ebx		/* convert limbs to bytes */
+	CHECK_BOUNDS_BOTH_WIDE (%edi, RES(%esp), %ebx)
+	CHECK_BOUNDS_BOTH_WIDE (%esi, S(%esp), %ebx)
+	shrl	$2, %ebx
+#endif
 
 /* We can use faster code for shift-by-1 under certain conditions.  */
 	cmp	$1,%ecx
@@ -222,4 +229,4 @@ L(L1):	movl	%edx,(%edi)		/* store last limb */
 
 	LEAVE
 	ret
-END(__mpn_lshift)
+END (BP_SYM (__mpn_lshift))
diff --git a/sysdeps/i386/i586/memcpy.S b/sysdeps/i386/i586/memcpy.S
index ed35b48..514f82e 100644
--- a/sysdeps/i386/i586/memcpy.S
+++ b/sysdeps/i386/i586/memcpy.S
@@ -20,6 +20,7 @@
 
 #include <sysdep.h>
 #include "asm-syntax.h"
+#include "bp-sym.h"
 #include "bp-asm.h"
 
 /* BEWARE: `#ifdef memcpy' means that memcpy is redefined as `mempcpy',
@@ -34,7 +35,7 @@
 #define LEN	SRC+PTR_SIZE
 
         .text
-ENTRY (memcpy)
+ENTRY (BP_SYM (memcpy))
 	ENTER
 
 	pushl	%edi
@@ -43,6 +44,8 @@ ENTRY (memcpy)
 	movl	DEST(%esp), %edi
 	movl	SRC(%esp), %esi
 	movl	LEN(%esp), %ecx
+	CHECK_BOUNDS_BOTH_WIDE (%edi, DEST(%esp), %ecx)
+	CHECK_BOUNDS_BOTH_WIDE (%esi, SRC(%esp), %ecx)
 	movl	%edi, %eax
 
 	/* We need this in any case.  */
@@ -112,4 +115,4 @@ L(1):	rep; movsb
 
 	LEAVE
 	RET_PTR
-END (memcpy)
+END (BP_SYM (memcpy))
diff --git a/sysdeps/i386/i586/mempcpy.S b/sysdeps/i386/i586/mempcpy.S
index 03dc078..d4611c2 100644
--- a/sysdeps/i386/i586/mempcpy.S
+++ b/sysdeps/i386/i586/mempcpy.S
@@ -1,4 +1,4 @@
 #define memcpy __mempcpy
 #include <sysdeps/i386/i586/memcpy.S>
 
-weak_alias (__mempcpy, mempcpy)
+weak_alias (BP_SYM (__mempcpy), BP_SYM (mempcpy))
diff --git a/sysdeps/i386/i586/memset.S b/sysdeps/i386/i586/memset.S
index 8b292e9..931832b 100644
--- a/sysdeps/i386/i586/memset.S
+++ b/sysdeps/i386/i586/memset.S
@@ -21,6 +21,7 @@
 
 #include <sysdep.h>
 #include "asm-syntax.h"
+#include "bp-sym.h"
 #include "bp-asm.h"
 
 /* BEWARE: `#ifdef memset' means that memset is redefined as `bzero' */
@@ -37,18 +38,18 @@
 #endif
 
         .text
-ENTRY (memset)
+ENTRY (BP_SYM (memset))
 	ENTER
 
 	pushl	%edi
 
 	movl	DEST(%esp), %edi
 	movl	LEN(%esp), %edx
+	CHECK_BOUNDS_BOTH_WIDE (%edi, DEST(%esp), %edx)
 #if BZERO_P
 	xorl	%eax, %eax	/* we fill with 0 */
 #else
 	movb	CHR(%esp), %al
-
 	movb	%al, %ah
 	movl	%eax, %ecx
 	shll	$16, %eax
@@ -101,7 +102,8 @@ L(2):	shrl	$2, %ecx	/* convert byte count to longword count */
 
 #if !BZERO_P
 	/* Load result (only if used as memset).  */
-	movl	DEST(%esp), %eax
+	movl DEST(%esp), %eax	/* start address of destination is result */
+	RETURN_BOUNDED_POINTER (DEST(%esp))
 #endif
 	popl	%edi
 
@@ -111,4 +113,4 @@ L(2):	shrl	$2, %ecx	/* convert byte count to longword count */
 #else
 	RET_PTR
 #endif
-END (memset)
+END (BP_SYM (memset))
diff --git a/sysdeps/i386/i586/rshift.S b/sysdeps/i386/i586/rshift.S
index 00b4cb7..e82f175 100644
--- a/sysdeps/i386/i586/rshift.S
+++ b/sysdeps/i386/i586/rshift.S
@@ -19,6 +19,7 @@
 
 #include "sysdep.h"
 #include "asm-syntax.h"
+#include "bp-sym.h"
 #include "bp-asm.h"
 
 #define PARMS	LINKAGE+16		/* space for 4 saved regs */
@@ -28,7 +29,7 @@
 #define CNT	SIZE+4
 
 	.text
-ENTRY(__mpn_rshift)
+ENTRY (BP_SYM (__mpn_rshift))
 	ENTER
 
 	pushl	%edi
@@ -40,6 +41,12 @@ ENTRY(__mpn_rshift)
 	movl	S(%esp),%esi
 	movl	SIZE(%esp),%ebx
 	movl	CNT(%esp),%ecx
+#if __BOUNDED_POINTERS__
+	shll	$2, %ebx		/* convert limbs to bytes */
+	CHECK_BOUNDS_BOTH_WIDE (%edi, RES(%esp), %ebx)
+	CHECK_BOUNDS_BOTH_WIDE (%esi, S(%esp), %ebx)
+	shrl	$2, %ebx
+#endif
 
 /* We can use faster code for shift-by-1 under certain conditions.  */
 	cmp	$1,%ecx
@@ -222,4 +229,4 @@ L(L1):	movl	%edx,(%edi)		/* store last limb */
 
 	LEAVE
 	ret
-END(__mpn_rshift)
+END (BP_SYM (__mpn_rshift))
diff --git a/sysdeps/i386/i586/strchr.S b/sysdeps/i386/i586/strchr.S
index bf351f6..bff1b8a 100644
--- a/sysdeps/i386/i586/strchr.S
+++ b/sysdeps/i386/i586/strchr.S
@@ -21,6 +21,7 @@
 
 #include <sysdep.h>
 #include "asm-syntax.h"
+#include "bp-sym.h"
 #include "bp-asm.h"
 
 /* This version is especially optimized for the i586 (and following?)
@@ -42,7 +43,7 @@
 #define CHR	STR+PTR_SIZE
 
 	.text
-ENTRY (strchr)
+ENTRY (BP_SYM (strchr))
 	ENTER
 
 	pushl %edi		/* Save callee-safe registers.  */
@@ -53,6 +54,7 @@ ENTRY (strchr)
 
 	movl STR(%esp), %eax
 	movl CHR(%esp), %edx
+	CHECK_BOUNDS_LOW (%eax, STR(%esp))
 
 	movl %eax, %edi		/* duplicate string pointer for later */
 	xorl %ecx, %ecx		/* clear %ecx */
@@ -279,7 +281,9 @@ L(5):	subl $4, %eax		/* adjust pointer */
 
 	incl %eax		/* increment pointer */
 
-L(2):	popl %ebp		/* restore saved registers */
+L(2):	CHECK_BOUNDS_HIGH (%eax, STR(%esp), jb)
+	RETURN_BOUNDED_POINTER (STR(%esp))
+	popl %ebp		/* restore saved registers */
 	popl %ebx
 
 	popl %esi
@@ -321,8 +325,8 @@ L(4):	subl $4, %eax		/* adjust pointer */
 	cmpb %dl, %ch		/* fourth byte == C? */
 	je L(2)			/* yes => return pointer */
 
-L(3):	xorl %eax, %eax		/* set return value = NULL */
-
+L(3):	xorl %eax, %eax
+	RETURN_NULL_BOUNDED_POINTER
 	popl %ebp		/* restore saved registers */
 	popl %ebx
 
@@ -331,7 +335,7 @@ L(3):	xorl %eax, %eax		/* set return value = NULL */
 
 	LEAVE
 	RET_PTR
-END (strchr)
+END (BP_SYM (strchr))
 
 #undef index
-weak_alias (strchr, index)
+weak_alias (BP_SYM (strchr), BP_SYM (index))
diff --git a/sysdeps/i386/i586/strcpy.S b/sysdeps/i386/i586/strcpy.S
index a48fbb6..03c4e77 100644
--- a/sysdeps/i386/i586/strcpy.S
+++ b/sysdeps/i386/i586/strcpy.S
@@ -20,6 +20,7 @@
 
 #include <sysdep.h>
 #include "asm-syntax.h"
+#include "bp-sym.h"
 #include "bp-asm.h"
 
 #define PARMS	LINKAGE+12	/* space for 3 saved regs */
@@ -34,7 +35,7 @@
 #define magic 0xfefefeff
 
 	.text
-ENTRY(STRCPY)
+ENTRY (BP_SYM (STRCPY))
 	ENTER
 
 	pushl	%edi
@@ -43,6 +44,8 @@ ENTRY(STRCPY)
 
 	movl	DEST(%esp), %edi
 	movl	SRC(%esp), %esi
+	CHECK_BOUNDS_LOW (%edi, DEST(%esp))
+	CHECK_BOUNDS_LOW (%esi, SRC(%esp))
 
 	xorl	%eax, %eax
 	leal	-1(%esi), %ecx
@@ -142,15 +145,17 @@ L(4):	movb	%dl, (%edi)
 L(end):	movb	%ah, (%edi)
 
 L(end2):
+	/* GKM FIXME: check high bounds  */
 #ifdef USE_AS_STPCPY
 	movl	%edi, %eax
 #else
 	movl	DEST(%esp), %eax
 #endif
+	RETURN_BOUNDED_POINTER (DEST(%esp))
 	popl	%ebx
 	popl	%esi
 	popl	%edi
 
 	LEAVE
 	RET_PTR
-END(STRCPY)
+END (BP_SYM (STRCPY))
diff --git a/sysdeps/i386/i586/strlen.S b/sysdeps/i386/i586/strlen.S
index e277126..6af9da9 100644
--- a/sysdeps/i386/i586/strlen.S
+++ b/sysdeps/i386/i586/strlen.S
@@ -21,6 +21,7 @@
 
 #include <sysdep.h>
 #include "asm-syntax.h"
+#include "bp-sym.h"
 #include "bp-asm.h"
 
 /* This version is especially optimized for the i586 (and following?)
@@ -40,10 +41,11 @@
 #define STR	PARMS
 
 	.text
-ENTRY(strlen)
+ENTRY (BP_SYM (strlen))
 	ENTER
 
 	movl STR(%esp), %eax
+	CHECK_BOUNDS_LOW (%eax, STR(%esp))
 	movl $3, %edx		/* load mask (= 3) */
 
 	andl %eax, %edx		/* separate last two bits of address */
@@ -177,9 +179,10 @@ L(3):	subl $4, %eax		/* correct too early pointer increment */
 
 	incl %eax		/* increment pointer */
 
-L(2):	subl STR(%esp), %eax	/* now compute the length as difference
+L(2):	CHECK_BOUNDS_HIGH (%eax, STR(%esp), jb)
+	subl STR(%esp), %eax	/* now compute the length as difference
 				   between start and terminating NUL
 				   character */
 	LEAVE
 	ret
-END (strlen)
+END (BP_SYM (strlen))
diff --git a/sysdeps/i386/i586/sub_n.S b/sysdeps/i386/i586/sub_n.S
index fcb13f1..0b5de92 100644
--- a/sysdeps/i386/i586/sub_n.S
+++ b/sysdeps/i386/i586/sub_n.S
@@ -20,6 +20,7 @@
 
 #include "sysdep.h"
 #include "asm-syntax.h"
+#include "bp-sym.h"
 #include "bp-asm.h"
 
 #define PARMS	LINKAGE+16		/* space for 4 saved regs */
@@ -29,7 +30,7 @@
 #define SIZE	S2+PTR_SIZE
 
 	.text
-ENTRY(__mpn_sub_n)
+ENTRY (BP_SYM (__mpn_sub_n))
 	ENTER
 
 	pushl	%edi
@@ -41,7 +42,13 @@ ENTRY(__mpn_sub_n)
 	movl	S1(%esp),%esi
 	movl	S2(%esp),%ebx
 	movl	SIZE(%esp),%ecx
-
+#if __BOUNDED_POINTERS__
+	shll	$2, %ecx	/* convert limbs to bytes */
+	CHECK_BOUNDS_BOTH_WIDE (%edi, RES(%esp), %ecx)
+	CHECK_BOUNDS_BOTH_WIDE (%esi, S1(%esp), %ecx)
+	CHECK_BOUNDS_BOTH_WIDE (%ebx, S2(%esp), %ecx)
+	shrl	$2, %ecx
+#endif
 	movl	(%ebx),%ebp
 
 	decl	%ecx
@@ -127,4 +134,4 @@ L(end2):
 
 	LEAVE
 	ret
-END(__mpn_sub_n)
+END (BP_SYM (__mpn_sub_n))