public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug driver/112983] New: gcc.cc: do_spec_1, ICE if missing '}' for %x{...}
@ 2023-12-12 10:27 pexu@gcc-bugzilla.mail.kapsi.fi
2023-12-12 23:03 ` [Bug driver/112983] " pinskia at gcc dot gnu.org
0 siblings, 1 reply; 2+ messages in thread
From: pexu@gcc-bugzilla.mail.kapsi.fi @ 2023-12-12 10:27 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112983
Bug ID: 112983
Summary: gcc.cc: do_spec_1, ICE if missing '}' for %x{...}
Product: gcc
Version: 14.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: driver
Assignee: unassigned at gcc dot gnu.org
Reporter: pexu@gcc-bugzilla.mail.kapsi.fi
Target Milestone: ---
Hi.
# cat bracegracemisery.specs
*self_spec: %x{
# gcc --specs=bracegracemisery.specs -E - < /dev/null > /dev/null
Segmentation fault (core dumped)
Happens because when looking for the terminating '}' character the loop
condition does not check if the input buffer runs out.
gcc.cc:
https://gcc.gnu.org/git/?p=gcc.git;a=blob;f=gcc/gcc.cc;h=701f5cdfb59c8f60c9c9bee310ef9de03d1ece27;hb=refs/heads/master#l6683
6683: while (*p++ != '}')
6684: ;
Due to memory layout reproducing this might be difficult (or impossible) or
yield other diagnosted errors (should the out of bounds read contain the
terminating character prior an invalid memory location is accessed).
^ permalink raw reply [flat|nested] 2+ messages in thread
* [Bug driver/112983] gcc.cc: do_spec_1, ICE if missing '}' for %x{...}
2023-12-12 10:27 [Bug driver/112983] New: gcc.cc: do_spec_1, ICE if missing '}' for %x{...} pexu@gcc-bugzilla.mail.kapsi.fi
@ 2023-12-12 23:03 ` pinskia at gcc dot gnu.org
0 siblings, 0 replies; 2+ messages in thread
From: pinskia at gcc dot gnu.org @ 2023-12-12 23:03 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112983
Andrew Pinski <pinskia at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Last reconfirmed| |2023-12-12
Ever confirmed|0 |1
Status|UNCONFIRMED |NEW
Known to fail| |2.95
--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed, this code has been there since the driver code was added to revision
control back in 1992.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-12-12 23:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-12-12 10:27 [Bug driver/112983] New: gcc.cc: do_spec_1, ICE if missing '}' for %x{...} pexu@gcc-bugzilla.mail.kapsi.fi
2023-12-12 23:03 ` [Bug driver/112983] " pinskia at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).