This is the mail archive of the
gcc-patches@gcc.gnu.org
mailing list for the GCC project.
Re: [PATCH] Fix PR64078
- From: Tom de Vries <Tom_deVries at mentor dot com>
- To: Bernd Edlinger <bernd dot edlinger at hotmail dot de>, Marek Polacek <polacek at redhat dot com>
- Cc: Jeff Law <law at redhat dot com>, "gcc-patches at gcc dot gnu dot org" <gcc-patches at gcc dot gnu dot org>, Jakub Jelinek <jakub at redhat dot com>, "H.J. Lu" <hjl dot tools at gmail dot com>
- Date: Tue, 30 Aug 2016 10:21:29 +0200
- Subject: Re: [PATCH] Fix PR64078
- Authentication-results: sourceware.org; auth=none
- References: <DUB118-W242786F48D078983D0B3DAE4550@phx.gbl> <20150907100700.GC30849@redhat.com> <DUB118-W39447996258C266A1D63AFE4540@phx.gbl> <55EF3690.8030201@redhat.com> <DUB118-W441CDEC82B86B82325CA23E4520@phx.gbl> <55F050D5.3020408@redhat.com> <DUB118-W29D540E8FAA34840CA988CE4520@phx.gbl> <20150917150026.GC27588@redhat.com> <55FAECA8.3070909@redhat.com> <DUB118-W4175AF780B5B3FD98AA47E45A0@phx.gbl> <20150917180838.GE27588@redhat.com> <7fcd8db4-af35-a0fe-fc5a-f7999d0c5fca@mentor.com> <AM4PR0701MB216213789F6D93DB003C9543E4E10@AM4PR0701MB2162.eurprd07.prod.outlook.com>
On 29/08/16 18:43, Bernd Edlinger wrote:
Thanks!
Actually my patch missed to fix one combination: -m32 with -fpic
make check-gcc-c++ RUNTESTFLAGS="ubsan.exp=object-size-9.c --tool_opts
'-m32 -fpic'"
FAIL: c-c++-common/ubsan/object-size-9.c -O2 execution test
FAIL: c-c++-common/ubsan/object-size-9.c -O2 -flto
-fno-use-linker-plugin -flto-partition=none execution test
The problem here is that the functions f2 and f3 access a stack-
based object out of bounds and that is inlined in main and
therefore smashes the return address of main in this case.
A possible fix could look like follows:
Index: object-size-9.c
===================================================================
--- object-size-9.c (revision 239794)
+++ object-size-9.c (working copy)
@@ -93,5 +93,9 @@
#endif
f4 (12);
f5 (12);
+#ifdef __cplusplus
+ /* Stack may be smashed by f2/f3 above. */
+ __builtin_exit (0);
+#endif
return 0;
}
Do you think that this should be fixed too?
I think it should be fixed. Ideally, we'd prevent the out-of-bounds
writes to have harmful effects, but I'm not sure how to enforce that.
This works for me:
...
diff --git a/gcc/testsuite/c-c++-common/ubsan/object-size-9.c
b/gcc/testsuite/c-c++-common/ubsan/object-size-9.c
index 46f1fb9..fec920d 100644
--- a/gcc/testsuite/c-c++-common/ubsan/object-size-9.c
+++ b/gcc/testsuite/c-c++-common/ubsan/object-size-9.c
@@ -31,6 +31,7 @@ static struct C
f2 (int i)
{
struct C x;
+ struct C x2;
x.d[i] = 'z';
return x;
}
@@ -45,6 +46,7 @@ static struct C
f3 (int i)
{
struct C x;
+ struct C x2;
char *p = x.d;
p += i;
*p = 'z';
...
But I have no idea how stable this solution is.
Thanks,
- Tom