From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 65F333857BA7; Fri, 5 Jan 2024 03:09:08 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 65F333857BA7 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1704424148; bh=CDrvDHO24UyNEL3OVLuGy6a/kNJqUNl18GSVf4ozGpc=; h=From:To:Subject:Date:In-Reply-To:References:From; b=CE47vPNDdPEEC22ouw6OjsUTNYt1d6Dc8rPv3Agz+INCE/gdVYxLJIX3IpCZyvfyq PuqPvM5xjU+eJO6kUZe177bNkpqMrNRr1hIw4H2Ns0rthoOLmjJ6hG/Y0cJYpRSBpr yS2xyfyWci83Fb0c4DnkQnmyL6XgoeT73hp+rhTw= From: "jiangchuanganghw at outlook dot com" To: gcc-bugs@gcc.gnu.org Subject: [Bug ipa/112783] core dump on libxo when function is inlined Date: Fri, 05 Jan 2024 03:09:06 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: ipa X-Bugzilla-Version: 14.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: jiangchuanganghw at outlook dot com X-Bugzilla-Status: RESOLVED X-Bugzilla-Resolution: MOVED X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: cc Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D112783 Jiang ChuanGang changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jiangchuanganghw at outloo= k dot co | |m --- Comment #9 from Jiang ChuanGang -= -- (In reply to Andrew Pinski from comment #3) > The problem is not in GCC but rather a bad assumption on the code part. >=20 > Basically we have: >=20 > memcpy(nbuf, name, nlen); > ... >=20 >=20 > if (!name) > ... >=20 >=20 > But the check after a memcpy can be removed as passing a null pointer to > memcpy is undefined even if nlen is 0 here. >=20 >=20 > This patch to the sources fixes the issue for me: > ``` > diff --git a/libxo/libxo.c b/libxo/libxo.c > index 916a111..ea71723 100644 > --- a/libxo/libxo.c > +++ b/libxo/libxo.c > @@ -4300,7 +4300,8 @@ xo_format_value (xo_handle_t *xop, const char *name, > ssize_t nlen, > if ((xsp->xs_flags & (XSF_EMIT | XSF_EMIT_KEY)) > || !(xsp->xs_flags & XSF_EMIT_LEAF_LIST)) { > char nbuf[nlen + 1]; > - memcpy(nbuf, name, nlen); > + if (name) > + memcpy(nbuf, name, nlen); > nbuf[nlen] =3D '\0'; >=20 > ssize_t rc =3D xo_transition(xop, 0, nbuf, XSS_EMIT_LEAF_LIST= ); > @@ -4324,7 +4325,8 @@ xo_format_value (xo_handle_t *xop, const char *name, > ssize_t nlen, >=20 > } else if (!(xsp->xs_flags & XSF_EMIT_KEY)) { > char nbuf[nlen + 1]; > - memcpy(nbuf, name, nlen); > + if (name) > + memcpy(nbuf, name, nlen); > nbuf[nlen] =3D '\0'; >=20 > ssize_t rc =3D xo_transition(xop, 0, nbuf, XSS_EMIT); > @@ -4342,7 +4344,8 @@ xo_format_value (xo_handle_t *xop, const char *name, > ssize_t nlen, > if ((xsp->xs_flags & XSF_EMIT_LEAF_LIST) > || !(xsp->xs_flags & XSF_EMIT)) { > char nbuf[nlen + 1]; > - memcpy(nbuf, name, nlen); > + if (name) > + memcpy(nbuf, name, nlen); > nbuf[nlen] =3D '\0'; >=20 > ssize_t rc =3D xo_transition(xop, 0, nbuf, XSS_EMIT); >=20 > ``` I've encountered the same bug, and your solution does fix it. But strangely enough, I can't reproduce it with code like the following. The inevitable condition of this bug still puzzles me. Do you have any thou= ghts on this. #include #include static const char *xo_xml_leader_len(const char *name, int len) { if (name =3D=3D NULL || name[0] =3D=3D '_') return ""; return "_"; } void test() { char *name =3D NULL; int len =3D 0; char mbuf[len + 1]; memcpy(mbuf, name, len); mbuf[len] =3D '\0'; const char *leader =3D xo_xml_leader_len(name, len); printf("leader: %s", leader); } int main() { test(); return 0; }=