c/4925: __builtin_memcpy overcopies on ix86 in gcc 3.0.2 [Get raw message]

[ian at airs dot com]

>Number:         4925
>Category:       c
>Synopsis:       __builtin_memcpy overcopies on ix86 in gcc 3.0.2
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          wrong-code
>Submitter-Id:   net
>Arrival-Date:   Wed Nov 21 16:26:00 PST 2001
>Closed-Date:
>Last-Modified:
>Originator:     Ian Lance Taylor
>Release:        3.0.2
>Organization:
>Environment:
System: Linux daffy.airs.com 2.2.18 #5 Tue Feb 6 13:57:37 PST 2001 i686 unknown
Architecture: i686

	
host: i686-pc-linux-gnu
build: i686-pc-linux-gnu
target: i686-pc-linux-gnu
configured with: ../../tools/egcs/configure  : (reconfigured) ../../tools/egcs/configure --with-gcc-version-trigger=/home/ian/tools/tools/egcs/gcc/version.c --host=i686-pc-linux-gnu --enable-shared=libstdc++
>Description:

On the ix86, with gcc 3.0.2, when compiling with optimization,
__builtin_memcpy can copy bytes which it should not copy.  The
following program demonstrates the problem.  This is an example of the
common C idiom in which a trailing field in a struct is only partially
allocated and used.  The test program does not show the partial
allocation, but it does show that __builtin_memcpy overwrites a byte
which it should not overwrite.

This program exits 0 when compiled without optimization and run.  It
exits 1 when compiled with optimization (-O) and run.

This bug causes a miscompilation of Postgres 7.1.3 when configured
with --enable-cassert.  In actual practice the code calls memcpy,
which gcc automatically translates into __builtin_memcpy when
optimizing.

This bug does not appear to occur in the current development sources,
in which the i386 movstrsi handling has been at least somewhat
rewritten.  If there is a gcc 3.0.3 release, the fix should be
incorporated.

>How-To-Repeat:

struct s
{
  int i[20];
  short s;
  char f;
  char b[100];
};

struct s s1;

int
main()
{
  struct s s2;
  s2.b[0] = 100;
  __builtin_memcpy(&s2, &s1, ((unsigned int) &((struct s *)0)->b));
  exit(s2.b[0] != 100);
}


>Fix:
	
>Release-Note:
>Audit-Trail:
>Unformatted: