From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 573963870C35; Wed, 26 Jun 2024 13:26:40 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 573963870C35 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1719408400; bh=ZP3wgxkPf9xhOjmpMeryJUyRWqcq6oe+HqeT4tBeegU=; h=From:To:Subject:Date:From; b=hrj5nBa+iXP336XnhpoIru7VNRBIF0VvK9gi6domEyHAZ1Ubqp1Q8B2+xkcUrRrEo Ke2IHFfbl8S1VRevqy60urIMiD5ASOQTTjyD0wFMu1b8hsRLTfsMwCNYCLGfwrbeZs Xjf4vCSMrsnADNJc32C0MCHw/8oUUAvpvd9FZxw4= From: "saulius.grazulis at bti dot vu.lt" To: gcc-bugs@gcc.gnu.org Subject: [Bug ada/115666] New: Cloaking access to subprogram in a record allows storing anonymous access-to-subprogram value Date: Wed, 26 Jun 2024 13:26:38 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: ada X-Bugzilla-Version: 15.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: saulius.grazulis at bti dot vu.lt X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter cc target_milestone attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D115666 Bug ID: 115666 Summary: Cloaking access to subprogram in a record allows storing anonymous access-to-subprogram value Product: gcc Version: 15.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: ada Assignee: unassigned at gcc dot gnu.org Reporter: saulius.grazulis at bti dot vu.lt CC: dkm at gcc dot gnu.org Target Milestone: --- Created attachment 58521 --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=3D58521&action=3Dedit A minimal working example of the access-to-subprogram check circumvention, ready for 'gnatchop' According to the Rationale for Ada 2005. 3.4 Downward closures [1], "[A]nonymous access to subprogram parameters /.../ do not carry an indicati= on of the accessibility level of the actual parameter but simply treat it as i= f it were infinite (strictly =E2=80=93 deeper than anything else). This of cours= e prevents the conversion to the type APT and all is well; this is detected at compile time." However, if the 'access procedure' type (APT) is a field of a record, then a value of such field can be initialized using an anonymous access to procedu= re value, and later values of such record can be freely copied around, essenti= ally circumventing the check mentioned in [1] and leading to programs that compi= le without warnings but have unpredictable behavior. NB: This is not the same as bug #84194; that one is fixed in the new compil= er. Ref.: [1] Rationale for Ada 2005. 3.4 Downward closures. URL: https://www.adaic.org/resources/add_content/standards/05rat/html/Rat-3-4.ht= ml Below is the minimal working example ('minimal-working-example.ada') and a = log demonstrating this situation: saulius@pterodaktilis minimal-working-example/ $ gnatchop -w minimal-working-example.ada=20 splitting minimal-working-example.ada into: access_procedure_assignment.adb function_pointers.adb function_pointers.ads saulius@pterodaktilis minimal-working-example/ $ gnatmake -gnata access_procedure_assignment.adb gcc -c -gnata access_procedure_assignment.adb gcc -c -gnata function_pointers.adb gnatbind -x access_procedure_assignment.ali gnatlink access_procedure_assignment.ali # Expected behavior: gnat compiler preventing assignment of the 'Function_Pointer_Wrapper'; # Actuall behaviour: the program compiles without errors or warnings but crashes when run; the run-time behavior is unpredictable (from no error to STORAGE_ERROR to 'segfault', depending on what other code is added): saulius@pterodaktilis minimal-working-example/ $ ./access_procedure_assignm= ent=20 PP.PPtr (B), main scope, after calling 'Evil_Crasher': raised STORAGE_ERROR : stack overflow or erroneous memory access saulius@pterodaktilis minimal-working-example/ $ lsb_release -a No LSB modules are available. Distributor ID: Linuxmint Description: Linux Mint 21.2 Release: 21.2 Codename: victoria saulius@pterodaktilis minimal-working-example/ $ uname -a Linux pterodaktilis 5.15.0-112-generic #122-Ubuntu SMP Thu May 23 07:48:21 = UTC 2024 x86_64 x86_64 x86_64 GNU/Linux saulius@pterodaktilis minimal-working-example/ $ gcc -v Using built-in specs. COLLECT_GCC=3Dgcc COLLECT_LTO_WRAPPER=3D/home/saulius/install/gcc/gcc-gnu-commit-7fada36c778/= libexec/gcc/x86_64-pc-linux-gnu/15.0.0/lto-wrapper Target: x86_64-pc-linux-gnu Configured with: ../gcc/configure --prefix=3D/home/saulius/install/gcc/gcc-gnu-commit-7fada36c778 --enable-languages=3Dc,c++,ada --disable-nls --disable-multilib --enable-sh= ared --enable-threads=3Dposix --enable-__cxa_atexit --enable-clocale=3Dgnu Thread model: posix Supported LTO compression algorithms: zlib gcc version 15.0.0 20240626 (experimental) (GCC)=20 saulius@pterodaktilis minimal-working-example/ $ gnat --version GNAT 15.0.0 20240626 (experimental) Copyright (C) 1996-2024, Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICU= LAR PURPOSE. saulius@pterodaktilis minimal-working-example/ $ which gnat /home/saulius/install/gcc/gcc-gnu-commit-7fada36c778/bin/gnat saulius@pterodaktilis minimal-working-example/ $ (cd ~/src/gcc; git remote = -v) origin git://gcc.gnu.org/git/gcc.git (fetch) origin git://gcc.gnu.org/git/gcc.git (push) saulius@pterodaktilis minimal-working-example/ $ (cd ~/src/gcc; git log --oneline -1) 7fada36c778 (HEAD -> master, origin/trunk, origin/master, origin/HEAD) [aarch64] Add support for -mcpu=3Dgrace=