Re: mudflap problem

["Doug Graham" <dgraham at nortelnetworks dot com>]

On Wed, Sep 29, 2004 at 06:05:56PM -0400, Frank Ch. Eigler wrote:
> 
> > I thought that since b+16 points to the base of a, mudflap would not
> > complain about the dereference in foo().  But it did somehow know that
> > the pointer passed in to foo() was derived from 'b' rather than 'a'.
> 
> I believe this is an optimization artifact.  With "-O2", the declaration of
> "a" is marked somehow as unused (it is), and libmudflap does not get
> a startup-time registration call for it.  Thus b[16] is checked and is found
> to refer to an invalid address.

Aha!  You're right, only 'b' is passed to __mf_register.  This happened
without -O2; my compile line was just: gcc -fmudflap -o foo foo.c.

> Adding some padding between static objects would help mudflap catch
> such off-by-one (but not off-by-many) accesses in the same way.
> 
> > [...]  My original intent was to suggest that maybe mudflap could
> > (perhaps optionally) check pointer arithmetic as well [...]
> 
> It might help catch more problems earlier and with more specificity,
> but this would require a lot more instrumentation code to be
> run, and thus slow down execution even more.

True, but without padding around static (and stack) objects, and without
any pointer arithmetic checking, there are a large number of common bugs
that it won't be able to catch.  It's hard to say, but I'd guess that
adding some padding around static and stack objects would catch most
of them.  The overhead of checking all pointer arithmetic may not be
worth it.

--Doug.