Bug report: Absolute function calls

Nate Eldredge neldredge@hmc.edu
Sat Oct 30 23:25:00 GMT 1999


This is a bug report against GCC 2.95.2 on i586-pc-linux-gnu.

Given the following (obviously broken) code, which tries to call the
function at address 0:

int main(void)
{
  ((void (*)())0)();
  return 0;
}

Compiled with `gcc -S foo.c'

The relevant instruction GCC generates for the call is "call 0".  The
GAS manual states that targets of calls and jumps are relative by
default, so this really just calls the next instruction.  This is not
what one expects.  The correct instruction would have been "call *0".

In this case, the correct code would have crashed, but GCC's code calls
the next instruction, runs through to the return, comes back, and
returns again, so the program exits successfully!

Btw, this also occurs trying to call addresses other than 0, and can
also happen if a variable pointer is written but optimized out of
existence.  The bug seems to have been present at least as far back as
GCC 2.7.2.3.

I realize one is invoking undefined behavior with such code and so GCC's
output is technically legal, but IMHO it's still wrong.

Otherwise, 2.95.2 seems to be working great.  Thanks for a quality
compiler! 
-- 

Nate Eldredge
neldredge@hmc.edu


More information about the Gcc-bugs mailing list