This is the mail archive of the
gcc-patches@gcc.gnu.org
mailing list for the GCC project.
[PATCH] Fix sanitizer/63690
- From: Marek Polacek <polacek at redhat dot com>
- To: Jakub Jelinek <jakub at redhat dot com>, GCC Patches <gcc-patches at gcc dot gnu dot org>
- Date: Wed, 19 Nov 2014 14:51:11 +0100
- Subject: [PATCH] Fix sanitizer/63690
- Authentication-results: sourceware.org; auth=none
As the testcase shows, we should really check first that we
have a MEM_REF, otherwise subsequent TREE_OPERAND might ICE.
On an invalid testcase we might get e.g. STRING_CST.
Bootstrapped/regtested on power8-linux, ok for trunk?
2014-11-19 Marek Polacek <polacek@redhat.com>
PR sanitizer/63690
* ubsan.c (instrument_object_size): Check for MEM_REF.
* gcc.dg/ubsan/pr63690.c: New test.
diff --git gcc/testsuite/gcc.dg/ubsan/pr63690.c gcc/testsuite/gcc.dg/ubsan/pr63690.c
index e69de29..bcf520a 100644
--- gcc/testsuite/gcc.dg/ubsan/pr63690.c
+++ gcc/testsuite/gcc.dg/ubsan/pr63690.c
@@ -0,0 +1,9 @@
+/* PR sanitizer/63690 */
+/* { dg-do compile } */
+/* { dg-options "-fsanitize=undefined" } */
+
+void
+foo (void)
+{
+ (*"c")++;
+}
diff --git gcc/ubsan.c gcc/ubsan.c
index 7d1e341..ad5665f 100644
--- gcc/ubsan.c
+++ gcc/ubsan.c
@@ -1539,7 +1539,13 @@ instrument_object_size (gimple_stmt_iterator *gsi, bool is_lhs)
return;
bool decl_p = DECL_P (inner);
- tree base = decl_p ? inner : TREE_OPERAND (inner, 0);
+ tree base;
+ if (decl_p)
+ base = inner;
+ else if (TREE_CODE (inner) == MEM_REF)
+ base = TREE_OPERAND (inner, 0);
+ else
+ return;
tree ptr = build1 (ADDR_EXPR, build_pointer_type (TREE_TYPE (t)), t);
while (TREE_CODE (base) == SSA_NAME)
Marek