[Bug middle-end/122035] Wrong behavior under -O2 and -O3 optimization

krzysiu858519851 at gmail dot com gcc-bugzilla@gcc.gnu.org
Tue Sep 23 19:45:55 GMT 2025


https://gcc.gnu.org/bugzilla/show_bug.cgi?id=122035

--- Comment #13 from Krzysztof Pecka <krzysiu858519851 at gmail dot com> ---
(In reply to Andrew Pinski from comment #12)
> (In reply to Krzysztof Pecka from comment #11)
> > Interesting. I honestly forgot about null character.
> > Still for me, interesting to see those different behaviors with different
> > optimization flags.
> 
> Well the behavior is undefined. 
> 
> Adding `-fsanitize=undefined -fsanitize=address` detects it too:
> ```
> =================================================================
> ==1==ERROR: AddressSanitizer: stack-buffer-overflow on address
> 0x7a581b800021 at pc 0x7e581e0d0163 bp 0x7ffdd94700c0 sp 0x7ffdd946f890
> READ of size 2 at 0x7a581b800021 thread T0
>     #0 0x7e581e0d0162 
> (/opt/compiler-explorer/gcc-snapshot/lib64/libasan.so.8+0x88162) (BuildId:
> 584e3e9072ba505191f9e87a73e5cd97f9c900fd)
>     #1 0x00000040838c in std::char_traits<char>::length(char const*)
> (/app/output.s+0x40838c) (BuildId: b96e3b53f7609bd71442daaaaa201f5f8521b3c9)
>     #2 0x00000041f7ba in std::__cxx11::basic_string<char,
> std::char_traits<char>, std::allocator<char> >::find_first_of(char const*,
> unsigned long) const (/app/output.s+0x41f7ba) (BuildId:
> b96e3b53f7609bd71442daaaaa201f5f8521b3c9)
>     #3 0x00000040658d in main (/app/output.s+0x40658d) (BuildId:
> b96e3b53f7609bd71442daaaaa201f5f8521b3c9)
>     #4 0x7e581d429d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId:
> d5197096f709801829b118af1b7cf6631efa2dcd)
>     #5 0x7e581d429e3f in __libc_start_main
> (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId:
> d5197096f709801829b118af1b7cf6631efa2dcd)
>     #6 0x000000405744 in _start (/app/output.s+0x405744) (BuildId:
> b96e3b53f7609bd71442daaaaa201f5f8521b3c9)
> 
> Address 0x7a581b800021 is located in stack of thread T0 at offset 33 in frame
>     #0 0x000000406373 in main (/app/output.s+0x406373) (BuildId:
> b96e3b53f7609bd71442daaaaa201f5f8521b3c9)
> 
>   This frame has 13 object(s):
>     [32, 33) 'semicolonChar' (line 42) <== Memory access at offset 33
> overflows this variable
>     [48, 56) '<unknown>'
>     [80, 88) '<unknown>'
>     [112, 120) '__for_begin' (line 77)
>     [144, 152) '__for_end' (line 77)
>     [176, 208) 'line' (line 41)
>     [240, 272) 'stationName' (line 45)
>     [304, 336) 'strTemp' (line 46)
>     [368, 400) '<unknown>'
>     [432, 464) '<unknown>'
>     [496, 552) 'stations' (line 38)
>     [592, 656) '<unknown>'
>     [688, 1080) 'inputFile' (line 39)
> HINT: this may be a false positive if your program uses some custom stack
> unwind mechanism, swapcontext or vfork
>       (longjmp and C++ exceptions *are* supported)
> SUMMARY: AddressSanitizer: stack-buffer-overflow (/app/output.s+0x40838c)
> (BuildId: b96e3b53f7609bd71442daaaaa201f5f8521b3c9) in
> std::char_traits<char>::length(char const*)
> Shadow bytes around the buggy address:
>   0x7a581b7ffd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x7a581b7ffe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x7a581b7ffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x7a581b7fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x7a581b7fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> =>0x7a581b800000: f1 f1 f1 f1[01]f2 00 f2 f2 f2 00 f2 f2 f2 00 f2
>   0x7a581b800080: f2 f2 00 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00
>   0x7a581b800100: 00 00 f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00
>   0x7a581b800180: 00 00 f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00
>   0x7a581b800200: 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 00
>   0x7a581b800280: 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00
> Shadow byte legend (one shadow byte represents 8 application bytes):
>   Addressable:           00
>   Partially addressable: 01 02 03 04 05 06 07 
>   Heap left redzone:       fa
>   Freed heap region:       fd
>   Stack left redzone:      f1
>   Stack mid redzone:       f2
>   Stack right redzone:     f3
>   Stack after return:      f5
>   Stack use after scope:   f8
>   Global redzone:          f9
>   Global init order:       f6
>   Poisoned by user:        f7
>   Container overflow:      fc
>   Array cookie:            ac
>   Intra object redzone:    bb
>   ASan internal:           fe
>   Left alloca redzone:     ca
>   Right alloca redzone:    cb
> ==1==ABORTING
> ```

Can you give me the command that prints you this? I am not getting anything,
after adding `-fsanitize=undefined -fsanitize=address`


More information about the Gcc-bugs mailing list