[Bug c/23506] New: Bad array access in DEF_GCC_BUILTIN

[Bug c/23506] New: Bad array access in DEF_GCC_BUILTIN

[falk at debian dot org]

We have in c-common.c:

#define DEF_BUILTIN(ENUM, NAME, CLASS, TYPE, LIBTYPE, BOTH_P, FALLBACK_P, \
		    NONANSI_P, ATTRS, IMPLICIT, COND)			\
  if (NAME && COND)							\
    def_builtin_1 (ENUM, NAME, CLASS,                                   \
                   builtin_types[(int) TYPE],                           \
                   builtin_types[(int) LIBTYPE],                        \
                   BOTH_P, FALLBACK_P, NONANSI_P,                       \
                   built_in_attributes[(int) ATTRS], IMPLICIT);

and in builtins.def

#define DEF_GCC_BUILTIN(ENUM, NAME, TYPE, ATTRS)		\
  DEF_BUILTIN (ENUM, "__builtin_" NAME, BUILT_IN_NORMAL, TYPE, BT_LAST,	\
               false, false, false, ATTRS, true, true)

so this line in builtins.def

DEF_GCC_BUILTIN        (BUILT_IN_HUGE_VAL, "huge_val", BT_FN_DOUBLE,
ATTR_CONST_NOTHROW_LIST)

expands to

if ("__builtin_" "huge_val" && 1) def_builtin_1 (BUILT_IN_HUGE_VAL, "__builtin_"
"huge_val", BUILT_IN_NORMAL, builtin_types[(int) BT_FN_DOUBLE],
builtin_types[(int) BT_LAST], 0, 0, 0, built_in_attributes[(int)
ATTR_CONST_NOTHROW_LIST], 1);

but builtin_types is declared in c-common.c as

  tree builtin_types[(int) BT_LAST];

so the access "builtin_types[(int) BT_LAST]" exceeds the array bounds.

-- 
           Summary: Bad array access in DEF_GCC_BUILTIN
           Product: gcc
           Version: 4.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: falk at debian dot org
                CC: gcc-bugs at gcc dot gnu dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23506

[Bug c/23506] [4.0/4.1 Regression] Bad array access in DEF_GCC_BUILTIN

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-08-23 13:15 -------
Confirmed, this is a regression from 3.4.0 where we did not have this access.

It looks like it was caused by:
2005-02-09  Richard Henderson  <rth@redhat.com>
        
        * builtins.c (DEF_BUILTIN): Add COND argument.
        * tree.h (DEF_BUILTIN): Likewise.
        * builtins.def (DEF_GCC_BUILTIN, DEF_LIB_BUILTIN, DEF_EXT_LIB_BUILTIN,
        DEF_C94_BUILTIN, DEF_C99_BUILTIN, DEF_C99_C90RES_BUILTIN): Update to
        match.
        (DEF_BUILTIN_STUB): New.
        (BUILT_IN_STACK_SAVE, BUILT_IN_STACK_RESTORE, BUILT_IN_INIT_TRAMPOLINE,
        BUILT_IN_ADJUST_TRAMPOLINE, BUILT_IN_NONLOCAL_GOTO,
        BUILT_IN_PROFILE_FUNC_ENTER, BUILT_IN_PROFILE_FUNC_EXIT): Use it.
        * c-common.c (DEF_BUILTIN): Add COND argument.
        * tree.c (local_define_builtin): New.
        (build_common_builtin_nodes): New.


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rth at gcc dot gnu dot org
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
   Last reconfirmed|0000-00-00 00:00:00         |2005-08-23 13:16:00
               date|                            |
            Summary|Bad array access in         |[4.0/4.1 Regression] Bad
                   |DEF_GCC_BUILTIN             |array access in
                   |                            |DEF_GCC_BUILTIN
   Target Milestone|---                         |4.0.2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23506

[Bug c/23506] [4.0/4.1 Regression] Bad array access in DEF_GCC_BUILTIN

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2005-08-26 16:27 -------
Subject: Bug 23506

CVSROOT:	/cvs/gcc
Module name:	gcc
Changes by:	jakub@gcc.gnu.org	2005-08-26 16:26:54

Modified files:
	gcc            : ChangeLog c-common.c 

Log message:
	PR c/23506
	* c-common.c (c_common_nodes_and_builtins): Increase builtin_types
	array by one element, initialize the BT_LAST element with NULL.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/ChangeLog.diff?cvsroot=gcc&r1=2.9829&r2=2.9830
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/c-common.c.diff?cvsroot=gcc&r1=1.650&r2=1.651



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23506

[Bug c/23506] [4.0 Regression] Bad array access in DEF_GCC_BUILTIN

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-08-26 17:14 -------
Fixed on the mainline at least.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |4.0.0
      Known to work|                            |3.4.4 4.1.0
            Summary|[4.0/4.1 Regression] Bad    |[4.0 Regression] Bad array
                   |array access in             |access in DEF_GCC_BUILTIN
                   |DEF_GCC_BUILTIN             |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23506

[Bug c/23506] [4.0 Regression] Bad array access in DEF_GCC_BUILTIN

[bonzini at gcc dot gnu dot org]

------- Additional Comments From bonzini at gcc dot gnu dot org  2005-08-29 15:02 -------
Maybe the patch could be backported to 4.0?

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23506

[Bug c/23506] [4.0 Regression] Bad array access in DEF_GCC_BUILTIN

[jakub at gcc dot gnu dot org]

------- Additional Comments From jakub at gcc dot gnu dot org  2005-09-01 14:42 -------
Richard, are you ok with putting this into 4.0?
Bootstrapped/regtested on 7 linux arches.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |jakub at gcc dot gnu dot org
                   |dot org                     |
             Status|NEW                         |ASSIGNED
   Last reconfirmed|2005-08-23 13:16:00         |2005-09-01 14:42:53
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23506

[Bug c/23506] [4.0 Regression] Bad array access in DEF_GCC_BUILTIN

[rth at gcc dot gnu dot org]

------- Additional Comments From rth at gcc dot gnu dot org  2005-09-01 15:49 -------
Yes, I'm fine with that.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23506

[Bug c/23506] [4.0 Regression] Bad array access in DEF_GCC_BUILTIN

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2005-09-01 16:46 -------
Subject: Bug 23506

CVSROOT:	/cvs/gcc
Module name:	gcc
Branch: 	gcc-4_0-branch
Changes by:	jakub@gcc.gnu.org	2005-09-01 16:46:52

Modified files:
	gcc            : ChangeLog c-common.c 

Log message:
	PR c/23506
	* c-common.c (c_common_nodes_and_builtins): Increase builtin_types
	array by one element, initialize the BT_LAST element with NULL.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/ChangeLog.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=2.7592.2.405&r2=2.7592.2.406
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/c-common.c.diff?cvsroot=gcc&only_with_tag=gcc-4_0-branch&r1=1.606.2.7&r2=1.606.2.8



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23506

[Bug c/23506] [4.0 Regression] Bad array access in DEF_GCC_BUILTIN

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-09-01 16:48 -------
Fixed.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23506