This is the mail archive of the
gcc-bugs@gcc.gnu.org
mailing list for the GCC project.
[Bug c/23506] New: Bad array access in DEF_GCC_BUILTIN
- From: "falk at debian dot org" <gcc-bugzilla at gcc dot gnu dot org>
- To: gcc-bugs at gcc dot gnu dot org
- Date: 21 Aug 2005 17:57:13 -0000
- Subject: [Bug c/23506] New: Bad array access in DEF_GCC_BUILTIN
- Reply-to: gcc-bugzilla at gcc dot gnu dot org
We have in c-common.c:
#define DEF_BUILTIN(ENUM, NAME, CLASS, TYPE, LIBTYPE, BOTH_P, FALLBACK_P, \
NONANSI_P, ATTRS, IMPLICIT, COND) \
if (NAME && COND) \
def_builtin_1 (ENUM, NAME, CLASS, \
builtin_types[(int) TYPE], \
builtin_types[(int) LIBTYPE], \
BOTH_P, FALLBACK_P, NONANSI_P, \
built_in_attributes[(int) ATTRS], IMPLICIT);
and in builtins.def
#define DEF_GCC_BUILTIN(ENUM, NAME, TYPE, ATTRS) \
DEF_BUILTIN (ENUM, "__builtin_" NAME, BUILT_IN_NORMAL, TYPE, BT_LAST, \
false, false, false, ATTRS, true, true)
so this line in builtins.def
DEF_GCC_BUILTIN (BUILT_IN_HUGE_VAL, "huge_val", BT_FN_DOUBLE,
ATTR_CONST_NOTHROW_LIST)
expands to
if ("__builtin_" "huge_val" && 1) def_builtin_1 (BUILT_IN_HUGE_VAL, "__builtin_"
"huge_val", BUILT_IN_NORMAL, builtin_types[(int) BT_FN_DOUBLE],
builtin_types[(int) BT_LAST], 0, 0, 0, built_in_attributes[(int)
ATTR_CONST_NOTHROW_LIST], 1);
but builtin_types is declared in c-common.c as
tree builtin_types[(int) BT_LAST];
so the access "builtin_types[(int) BT_LAST]" exceeds the array bounds.
--
Summary: Bad array access in DEF_GCC_BUILTIN
Product: gcc
Version: 4.1.0
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: c
AssignedTo: unassigned at gcc dot gnu dot org
ReportedBy: falk at debian dot org
CC: gcc-bugs at gcc dot gnu dot org
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23506