[Bug middle-end/122035] Wrong behavior under -O2 and -O3 optimization
krzysiu858519851 at gmail dot com
gcc-bugzilla@gcc.gnu.org
Tue Sep 23 19:45:55 GMT 2025
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=122035
--- Comment #13 from Krzysztof Pecka <krzysiu858519851 at gmail dot com> ---
(In reply to Andrew Pinski from comment #12)
> (In reply to Krzysztof Pecka from comment #11)
> > Interesting. I honestly forgot about null character.
> > Still for me, interesting to see those different behaviors with different
> > optimization flags.
>
> Well the behavior is undefined.
>
> Adding `-fsanitize=undefined -fsanitize=address` detects it too:
> ```
> =================================================================
> ==1==ERROR: AddressSanitizer: stack-buffer-overflow on address
> 0x7a581b800021 at pc 0x7e581e0d0163 bp 0x7ffdd94700c0 sp 0x7ffdd946f890
> READ of size 2 at 0x7a581b800021 thread T0
> #0 0x7e581e0d0162
> (/opt/compiler-explorer/gcc-snapshot/lib64/libasan.so.8+0x88162) (BuildId:
> 584e3e9072ba505191f9e87a73e5cd97f9c900fd)
> #1 0x00000040838c in std::char_traits<char>::length(char const*)
> (/app/output.s+0x40838c) (BuildId: b96e3b53f7609bd71442daaaaa201f5f8521b3c9)
> #2 0x00000041f7ba in std::__cxx11::basic_string<char,
> std::char_traits<char>, std::allocator<char> >::find_first_of(char const*,
> unsigned long) const (/app/output.s+0x41f7ba) (BuildId:
> b96e3b53f7609bd71442daaaaa201f5f8521b3c9)
> #3 0x00000040658d in main (/app/output.s+0x40658d) (BuildId:
> b96e3b53f7609bd71442daaaaa201f5f8521b3c9)
> #4 0x7e581d429d8f (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId:
> d5197096f709801829b118af1b7cf6631efa2dcd)
> #5 0x7e581d429e3f in __libc_start_main
> (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId:
> d5197096f709801829b118af1b7cf6631efa2dcd)
> #6 0x000000405744 in _start (/app/output.s+0x405744) (BuildId:
> b96e3b53f7609bd71442daaaaa201f5f8521b3c9)
>
> Address 0x7a581b800021 is located in stack of thread T0 at offset 33 in frame
> #0 0x000000406373 in main (/app/output.s+0x406373) (BuildId:
> b96e3b53f7609bd71442daaaaa201f5f8521b3c9)
>
> This frame has 13 object(s):
> [32, 33) 'semicolonChar' (line 42) <== Memory access at offset 33
> overflows this variable
> [48, 56) '<unknown>'
> [80, 88) '<unknown>'
> [112, 120) '__for_begin' (line 77)
> [144, 152) '__for_end' (line 77)
> [176, 208) 'line' (line 41)
> [240, 272) 'stationName' (line 45)
> [304, 336) 'strTemp' (line 46)
> [368, 400) '<unknown>'
> [432, 464) '<unknown>'
> [496, 552) 'stations' (line 38)
> [592, 656) '<unknown>'
> [688, 1080) 'inputFile' (line 39)
> HINT: this may be a false positive if your program uses some custom stack
> unwind mechanism, swapcontext or vfork
> (longjmp and C++ exceptions *are* supported)
> SUMMARY: AddressSanitizer: stack-buffer-overflow (/app/output.s+0x40838c)
> (BuildId: b96e3b53f7609bd71442daaaaa201f5f8521b3c9) in
> std::char_traits<char>::length(char const*)
> Shadow bytes around the buggy address:
> 0x7a581b7ffd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 0x7a581b7ffe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 0x7a581b7ffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 0x7a581b7fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 0x7a581b7fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> =>0x7a581b800000: f1 f1 f1 f1[01]f2 00 f2 f2 f2 00 f2 f2 f2 00 f2
> 0x7a581b800080: f2 f2 00 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00
> 0x7a581b800100: 00 00 f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00
> 0x7a581b800180: 00 00 f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00
> 0x7a581b800200: 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 00
> 0x7a581b800280: 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00
> Shadow byte legend (one shadow byte represents 8 application bytes):
> Addressable: 00
> Partially addressable: 01 02 03 04 05 06 07
> Heap left redzone: fa
> Freed heap region: fd
> Stack left redzone: f1
> Stack mid redzone: f2
> Stack right redzone: f3
> Stack after return: f5
> Stack use after scope: f8
> Global redzone: f9
> Global init order: f6
> Poisoned by user: f7
> Container overflow: fc
> Array cookie: ac
> Intra object redzone: bb
> ASan internal: fe
> Left alloca redzone: ca
> Right alloca redzone: cb
> ==1==ABORTING
> ```
Can you give me the command that prints you this? I am not getting anything,
after adding `-fsanitize=undefined -fsanitize=address`
More information about the Gcc-bugs
mailing list