App crash due to ippsFindC_8u access violation

[Ricardo_Costa]

Hello,

I'm using the ippsFindC_8u function to implement the IPP version of strlen, as suggested by the "Optimizing Applications for Multi-Core Processors" book. However, the 32-bit version of the_p8_ownsFindC_8u function that is called by ippsFindC_8ureads beyond the '\0' escape character of the string,possibly causing a read access violation.

Here's a sample code that crashesdue to access violation when compiled with /O2 in MSVC 9 and using 32-bitIPP static libraries withdispatching:

-----

#define STRMAX ((1 << 30) - 1)

int my_strlen(char* cs)
{
int index;
ippsFindC_8u((Ipp8u*)cs, STRMAX, '\0', &index);
return index;
}

int main ()
{
ippStaticInit();

char* str = new char[18];

strcpy(str, "gate of expertise");

printf("%d\n", my_strlen(str)); // access violation - read beyond the end of the buffer

delete[] str;
}

-----

The my_strlen function is copied from the book (pg. 534). It works when compiled for x64, or when using the generic CPU version of the function. I'm running it on a Core 2 Quad Q9550.

Since the function asks for the buffer size, I'm not sure if there's a guarantee that the function wouldn't read beyond the character being searched, however this is what the officialIntel book suggests, and it works with other versions of the function as described above.

Regards,
Ricardo

[Vladimir_Dudnik]

Hi Ricardo,

I've passed this information to development team, they will review this and come back with comments

Regards,
Vladimir

[Alexander_Naduev__In]

Hi Ricardo,
it is not good idea to use IPP function in such a way. ippsFindC_8u function uses SSE instructions for processing of your string. In this case, reading of second 16-bytes chunk overruns the string bound. Unfortunately, the function doesn't know about it, because you set length = (1<<30)-1.

[Ricardo_Costa]

Quoting - Alexander Naduev (Intel)

Hi Ricardo,
it is not good idea to use IPP function in such a way. ippsFindC_8u function uses SSE instructions for processing of your string. In this case, reading of second 16-bytes chunk overruns the string bound. Unfortunately, the function doesn't know about it, because you set length = (1<<30)-1.

I see. So, the way proposed in the book is wrong. Thanks for the confirmation.

Regards,
Ricardo