Bug in GCC assembler

Bug in GCC assembler

[Tim Reago]

[-- Attachment #1: Type: text/plain, Size: 681 bytes --]

Hi BinUtils,

It looks like I may have found a bug in the gcc assembler, where the wrong op codes are being generated.  For all destination registers, the fixed source value gets changed.  For example:

add eax, dword ptr ds:[0x22222222]

Encodes to: 03 04 25 26 22 22 22
 Should be: 03 04 25 22 22 22 22

And,

add rax, qword ptr ds:[0x33333333]

Encodes to: 48 03 04 25 3B 33 33 33
 Should be: 48 03 04 25 33 33 33 33

The change in the address is the size of the data element (dword[4] or qword[8]).  As if it was looking at array_element[1] instead of array_element[0].  The change in the address is also not the size of the instruction in the case of dword.

Thanks,
Tim Reago

[-- Attachment #2: Type: text/rfc822-headers, Size: 2282 bytes --]

------ This is a copy of the headers of the original message. ------

Return-Path: <tim.reago@sksrt.net>
X-Authed-Username: dGltLnJlYWdvQHNrc3J0Lm5ldA==
Received: from [10.219.152.7] ([10.219.152.7:4122] helo=md34.nrtc.email-ash1.sync.lan)
	by mail.informnet.com (envelope-from <tim.reago@sksrt.net>)
	(ecelerity 4.4.1.20033 r(msys-ecelerity:tags/4.4.1.0^0)) with ESMTP
	id 82/56-17329-4864B556; Mon, 20 Nov 2023 06:44:04 -0500
Date: Mon, 20 Nov 2023 06:44:04 -0500 (EST)
From: Tim Reago <tim.reago@sksrt.net>
To: binutils@soureware.org
Message-ID: <797411109.53795384.1700480644401.JavaMail.zimbra@sksrt.net>
In-Reply-To: <1640557282.52422453.1700387115169.JavaMail.zimbra@sksrt.net>
References: <1640557282.52422453.1700387115169.JavaMail.zimbra@sksrt.net>
Subject: Re: Bug in GCC assembler
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Originating-IP: [162.249.149.70]
X-Mailer: Zimbra 8.8.15_GA_4272 (ZimbraWebClient - FF119 (Win)/8.8.15_GA_4257)
Thread-Topic: Bug in GCC assembler
Thread-Index: DQkmenzVmqsgbU3vwbocwM16D+ObzTQZC3PM
X-Vade-Verdict: clean
X-Vade-Analysis-1: gggruggvucftvghtrhhoucdtuddrgedvkedrudegjedgtdehucetufdoteggodetrfdotffvucfrrhho
X-Vade-Analysis-2: fhhilhgvmecuufgjpfetvefqtfdppfftvfevpdfgpfggqdfptffvvedpqfgfvfenuceurghilhhouhht
X-Vade-Analysis-3: mecufedtudenucenucfjughrpeffhffvkfgjfhfugggtgfhiofhtsehtjegttdertdejnecuhfhrohhm
X-Vade-Analysis-4: pefvihhmucftvggrghhouceothhimhdrrhgvrghgohesshhkshhrthdrnhgvtheqnecuggftrfgrthht
X-Vade-Analysis-5: vghrnhepleeliefgveeigffgueefvdffkeethfeijeeljeffvdejfeeuhefgfeeiffdtudeknecukfhp
X-Vade-Analysis-6: pedutddrvdduledrudehvddrjedpudeivddrvdegledrudegledrjedtnecuvehluhhsthgvrhfuihii
X-Vade-Analysis-7: vgeptdenucfrrghrrghmpehinhgvthepuddtrddvudelrdduhedvrdejpdhhvghlohepmhgufeegrdhn
X-Vade-Analysis-8: rhhttgdrvghmrghilhdqrghshhdurdhshihntgdrlhgrnhdpmhgrihhlfhhrohhmpehtihhmrdhrvggr
X-Vade-Analysis-9: ghhosehskhhsrhhtrdhnvghtpdhrtghpthhtohepsghinhhuthhilhhssehsohhurhgvfigrrhgvrdho
X-Vade-Analysis-10: rhhgpdhmthgrhhhoshhtpehsmhhtphdtvddrnhhrthgtrdgvmhgrihhlqdgrshhhuddrshihnhgtrdhl
X-Vade-Analysis-11: rghnpdhnsggprhgtphhtthhopedupdhishgpnhgrpehfrghlshgvpdgruhhthhgpuhhsvghrpehtihhm
X-Vade-Analysis-12: rdhrvggrghhosehskhhsrhhtrdhnvght
X-Vade-Client: NRTC

Re: Bug in GCC assembler

[Jan Beulich]

On 25.11.2023 01:21, Tim Reago wrote:
> Hi BinUtils,
> 
> It looks like I may have found a bug in the gcc assembler, where the wrong op codes are being generated.  For all destination registers, the fixed source value gets changed.  For example:
> 
> add eax, dword ptr ds:[0x22222222]
> 
> Encodes to: 03 04 25 26 22 22 22
>  Should be: 03 04 25 22 22 22 22
> 
> And,
> 
> add rax, qword ptr ds:[0x33333333]
> 
> Encodes to: 48 03 04 25 3B 33 33 33
>  Should be: 48 03 04 25 33 33 33 33

I cannot confirm this. Here's what I get with -al (gas 2.41):

GAS LISTING amd64.s                     page 1


   1                            .intel_syntax noprefix
   2                            .allow_index_reg
   3                            .text
   4                    _start:
   5
   6 0000 03042522              add eax, dword ptr ds:[0x22222222]
   6      222222
   7 0007 48030425              add rax, qword ptr ds:[0x33333333]
   7      33333333
   8                            .end

You didn't say what gas version. Plus I'm also confused by you saying
"gcc assembler" - you may not be talking about gas in the first place.

Jan