This is the mail archive of the
gcc@gcc.gnu.org
mailing list for the GCC project.
Re: operator new[] overflow (PR 19351)
- From: Gabriel Dos Reis <gdr at integrable-solutions dot net>
- To: Chris Lattner <clattner at apple dot com>
- Cc: Joe Buck <Joe dot Buck at synopsys dot com>, "Joseph S. Myers" <joseph at codesourcery dot com>, Florian Weimer <fw at deneb dot enyo dot de>, "gcc at gcc dot gnu dot org" <gcc at gcc dot gnu dot org>
- Date: Wed, 1 Dec 2010 20:51:30 -0600
- Subject: Re: operator new[] overflow (PR 19351)
- References: <87vd3eqzvg.fsf@mid.deneb.enyo.de> <Pine.LNX.4.64.1011302127210.14117@digraph.polyomino.org.uk> <AANLkTima1zd5tMx80G1-NB1UJ00tOF8=9iYJDxAAfYoc@mail.gmail.com> <20101130231211.GI13905@synopsys.com> <4FB8FB3B-2F0F-408C-A548-ADF7CE52A4A0@apple.com>
On Wed, Dec 1, 2010 at 5:36 PM, Chris Lattner <clattner@apple.com> wrote:
>
> On Nov 30, 2010, at 3:12 PM, Joe Buck wrote:
>
>> On Tue, Nov 30, 2010 at 01:49:23PM -0800, Gabriel Dos Reis wrote:
>>> The existing GCC behaviour is a bit more perverse than the
>>> C malloc() case as in
>>>
>>> ? ? ? new T[n]
>>>
>>> there is no multiplication that could be credited to careless programmer.
>>> The multiplication is introduced by GCC.
>>
>> ... which suggests strongly that GCC should fix it. ?Too bad the ABI is
>> frozen; if the internal ABI kept the two values (the size of the type, and
>> the number of values) separate and passed two arguments to the allocation
>> function, it would be easy to do the right thing (through bad_alloc if the
>> multiplication overflows).
>
> You don't need any ABI changes to support this. ?For example, clang compiles:
>
> int *foo(long X) {
> ?return new int[X];
> }
>
> into:
>
> __Z3fool: ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ## @_Z3fool
> Leh_func_begin0:
> ## BB#0: ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?## %entry
> ? ? ? ?movl ? ?$4, %ecx
> ? ? ? ?movq ? ?%rdi, %rax
> ? ? ? ?mulq ? ?%rcx
> ? ? ? ?testq ? %rdx, %rdx
> ? ? ? ?movq ? ?$-1, %rdi
> ? ? ? ?cmoveq ?%rax, %rdi
> ? ? ? ?jmp ? ? __Znam
>
> On overflow it just forces the size passed in to operator new to -1ULL, which throws bad_alloc.
This is a very good point. At the minimum, GCC should generate similar code
if not improve on it.
-- Gaby