From 56efde54f54982e120e7c4d5cd4e92f37416fed9 Mon Sep 17 00:00:00 2001 From: Zhaoqi Xu Date: Fri, 23 Oct 2026 19:06:41 -0400 Subject: [PATCH] emv: fix false -Wstringop-overflow in AID list rule with AVX2 Building the client with -march=x86-64-v3 (the CentOS/RHEL 10 baseline) fails with gcc 14: src/emv/emvcore.c:211:24: error: writing 32 bytes into a region of size 22 [-Werror=stringop-overflow=] gcc vectorizes the dash fill loop in aidlist_rule() into 32-byte stores and loses the pos + 2 < dstlen bound. The bound was correct. Compute the dash count with the same limit and fill it with memset, so there is no vectorized loop store to mis-size. Output is unchanged. Reported in #3671. Co-Authored-By: Grok Bot --- CHANGELOG.md | 1 + client/src/emv/emvcore.c | 9 +++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ecd958c9d..b75d3c732 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file. This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log... ## [unreleased][unreleased] +- Fixed client build with `-march=x86-64-v3` (CentOS/RHEL 10 default) - false `-Wstringop-overflow` in the EMV AID list table (@r3wretrhy) - Changed `hf seos info` - now prints UID, ATQA, SAK, ATS, MIFARE Classic emulation, which SEOS AIDs answer and the known AIDs found (@antoniovazquezblanco) - Fixed `hf seos managekeys -p` - key table columns stay aligned for slots 10 and up (@antoniovazquezblanco) - Fixed `aidlist.json` - uppercased the SEOS, TeslaDAP and LA Tap AIDs (@antoniovazquezblanco) diff --git a/client/src/emv/emvcore.c b/client/src/emv/emvcore.c index 24671a068..ace7356ae 100644 --- a/client/src/emv/emvcore.c +++ b/client/src/emv/emvcore.c @@ -207,9 +207,14 @@ static void aidlist_rule(char *dst, size_t dstlen, size_t w_aid, size_t w_prio, dst[pos++] = '+'; for (size_t c = 0; c < 3; c++) { - for (size_t i = 0; (i < widths[c] + 2) && (pos + 2 < dstlen); i++) { - dst[pos++] = '-'; + // memset, not a byte loop: gcc's AVX2 vectorized loop trips -Wstringop-overflow + size_t n = widths[c] + 2; + size_t room = (pos + 2 < dstlen) ? dstlen - pos - 2 : 0; + if (n > room) { + n = room; } + memset(dst + pos, '-', n); + pos += n; if (pos + 1 < dstlen) { dst[pos++] = '+'; }