Computing the length of a string in ARM

Question

I was trying to reverse the following ARM code.

mystery7
02 46            MOV R2, R0
08 B9            CBNZ R0, loc_100E1D8
00 20            MOVS R0, #0
70 47            BX LR
loc_100E1D8
90 F9 00 30      LDRSB.W R3, [R0]
02 E0            B loc_100E1E4
loc_100E1DE
01 32            ADDS R2, #1
92 F9 00 30      LDRSB.W R3, [R2]
loc_100E1E4
00 2B            CMP R3, #0
FA D1            BNE loc_100E1DE
10 1A            SUBS R0, R2, R0
6F F3 9F 70      BFC.W R0, #0x1E, #2
70 47            BX LR
; End of function mystery7

I can see that its a function that computes the length of a string. However the BFC.W instruction seems to clear the most significant 2 bits. So, the sign bit and the bit to its immediate right are cleared. Why is that done?

Answer 1

I post this as an "answer", because my reputation doesn't yet allow me a comment.

The problem is copied from the book "Practical Reverse Engineering" by Bruce Dang et al. as "mystery7", see Figure 2.13 in the book. The author himself does not comment on the strange BFC.W statement. This very statement has been commented in another blog here, as "I don’t understand the purpose of setting the two most significant bits of the difference to zero. Those bits shouldn’t be set in the first place for any reasonable strings."

Maybe that statement serves some purpose. If yes it might be rather obscure.