Bug 64920 - bootstrap-ubsan [build/gengtype -r gtype.state]: libiberty/regex.c:6970:11: runtime error: left shift of negative value -1
Summary: bootstrap-ubsan [build/gengtype -r gtype.state]: libiberty/regex.c:6970:11: r...
Status: RESOLVED WORKSFORME
Alias: None
Product: gcc
Classification: Unclassified
Component: middle-end (show other bugs)
Version: 5.0
: P3 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks: ubsan
  Show dependency treegraph
 
Reported: 2015-02-03 14:31 UTC by Tobias Burnus
Modified: 2018-04-03 07:36 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2018-03-01 00:00:00


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tobias Burnus 2015-02-03 14:31:33 UTC
Running bootstrap-ubsan on x86_64 shows the following error during stage 2 for

build/gengtype -r gtype.state

../../libiberty/regex.c:6970:11: runtime error: left shift of negative value -1
../../libiberty/regex.c:7165:4: runtime error: left shift of negative value -1


The debugger shows:

Breakpoint 3, byte_re_match_2_internal (bufp=bufp@entry=0x7fffffffda70, string1=string1@entry=0x0, size1=size1@entry=0, string2=string2@entry=0x93773d "../../gcc/objc/objc-next-runtime-abi-02.c", size2=size2@entry=41, pos=pos@entry=0, regs=0x7fffffffda50, stop=41)
    at ../../libiberty/regex.c:6970
6970              EXTRACT_NUMBER_AND_INCR (mcnt, p);

(gdb) p p
$3 = (unsigned char *) 0xb80116 "\362\377\002\001/\a\002"

(gdb) p mcnt
$4 = <optimized out>

(gdb) bt
#0  byte_re_match_2_internal (bufp=bufp@entry=0x7fffffffda70, string1=string1@entry=0x0, size1=size1@entry=0, string2=string2@entry=0x93773d "../../gcc/objc/objc-next-runtime-abi-02.c", size2=size2@entry=41, pos=pos@entry=0, regs=0x7fffffffda50, stop=41)
    at ../../libiberty/regex.c:6970
#1  0x0000000000439f63 in byte_re_search_2 (bufp=bufp@entry=0x7fffffffda70, string1=string1@entry=0x0, size1=size1@entry=0, string2=string2@entry=0x93773d "../../gcc/objc/objc-next-runtime-abi-02.c", size2=size2@entry=41, startpos=startpos@entry=0, range=1,
    regs=0x7fffffffda50, stop=41) at ../../libiberty/regex.c:5208
#2  0x00000000004442e8 in xre_search_2 (stop=<optimized out>, regs=<optimized out>, range=<optimized out>, startpos=0, size2=<optimized out>, string2=0x93773d "../../gcc/objc/objc-next-runtime-abi-02.c", size1=0, string1=0x0, bufp=<optimized out>)
    at ../../libiberty/regex.c:4961
#3  xre_search (regs=<optimized out>, range=<optimized out>, startpos=0, size=<optimized out>, string=0x93773d "../../gcc/objc/objc-next-runtime-abi-02.c", bufp=<optimized out>) at ../../libiberty/regex.c:4921
#4  xregexec (preg=0xb87f80, string=0x93773d "../../gcc/objc/objc-next-runtime-abi-02.c", nmatch=10, pmatch=0x7fffffffdb30, eflags=<optimized out>) at ../../libiberty/regex.c:8036
#5  0x0000000000413a29 in get_output_file_with_visibility (inpf=0x937730) at ../../gcc/gengtype.c:2221
#6  0x000000000041a148 in write_func_for_structure (orig_s=0x9377b0, s=0x9377b0, wtd=0x4743e0 <ggc_wtd>) at ../../gcc/gengtype.c:3512
#7  0x000000000041b80c in write_types (output_header=<optimized out>, structures=<optimized out>, wtd=0x4743e0 <ggc_wtd>) at ../../gcc/gengtype.c:3786
#8  0x0000000000404acd in main (argc=<optimized out>, argv=<optimized out>) at ../../gcc/gengtype.c:5368
Comment 1 Vittorio Zecca 2015-08-23 20:40:18 UTC
I have the same messages during gcc 5.2.0 generation

Fixing directory /usr/include into /home/vitti/gcc-5.2.0-sanitize-all/gcc/include-fixed
../../../gcc-5.2.0/libiberty/regex.c:6972:11: runtime error: left shift of negative value -1
../../../gcc-5.2.0/libiberty/regex.c:7167:4: runtime error: left shift of negative value -1
Applying machine_name             to slang.h

I believe this is because at line 688

(destination) += SIGN_EXTEND_CHAR (*((source) + 1)) << 8;

(*((source) + 1)) is negateive (-1)
Comment 2 Vittorio Zecca 2015-09-17 18:11:57 UTC
I propose the following fix at line 688 of regex.c in trunk

change

(destination) += SIGN_EXTEND_CHAR (*((source) + 1)) << 8 ;         \

into

(*((source) + 1)) >= 0 ? (destination) += SIGN_EXTEND_CHAR (*((source) + 1)) << 8 : (destination) ;         \

I admit I did not tested it (yet) but the idea is to shift only if the shiftee is not negative
Comment 3 Martin Liška 2018-03-01 09:33:33 UTC
Can't see it any longer in boostrap on x86. Can you please re-test it?
Comment 4 Vittorio Zecca 2018-04-03 06:01:31 UTC
Sorry for late answer, but I was traveling.

I did not see it any longer.
Comment 5 Martin Liška 2018-04-03 07:36:15 UTC
Then closing..