From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id AAF3E385781A; Tue, 26 Apr 2022 13:47:54 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org AAF3E385781A From: "jakub at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug sanitizer/105396] missed stack-buffer-overflow by -O0 Date: Tue, 26 Apr 2022 13:47:54 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: sanitizer X-Bugzilla-Version: 12.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: jakub at gcc dot gnu.org X-Bugzilla-Status: ASSIGNED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: marxin at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: gcc-bugs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-bugs mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Apr 2022 13:47:54 -0000 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D105396 --- Comment #2 from Jakub Jelinek --- I think the bug is visible in -fdump-rtl-expand-details dump: Partition 2: size 40 align 16 c Partition 1: size 8 align 8 b Partition 0: size 4 align 4 a_1 Partition 3: size 4 align 8 d Flushing rzbuffer at offset -160 with: f1 f1 f1 f1 Flushing rzbuffer at offset -128 with: 04 f2 00 00 Flushing rzbuffer at offset -128 with: 00 00 00 f2 Flushing rzbuffer at offset -96 with: f2 f2 00 00 Flushing rzbuffer at offset -64 with: 00 00 00 f3 Flushing rzbuffer at offset -32 with: f3 f3 f3 f3 There is a wrong flush such that the store of what I think should be 04 f2 00 f2 is done in 2 separate overlapping stores. Because the first var is just 4 bytes, after f1 f1 f1 f1 there should be 04 to indicate that only first 4 bytes of the 8 are valid, then f2 for the inter-var gap, then 00 for the 8 byte b variable, then 3 f2 bytes for 24 by= tes of gap and then 5 00 bytes for 40 bytes of c and then f3s till end of the frame.=