public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug sanitizer/59258] New: usan: ICE(segfault): stack-buffer-overflow with -fsanitize=undefined
@ 2013-11-23  0:44 burnus at gcc dot gnu.org
  2013-11-23 20:38 ` [Bug sanitizer/59258] " burnus at gcc dot gnu.org
                   ` (9 more replies)
  0 siblings, 10 replies; 11+ messages in thread
From: burnus at gcc dot gnu.org @ 2013-11-23  0:44 UTC (permalink / raw)
  To: gcc-bugs

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59258

            Bug ID: 59258
           Summary: usan: ICE(segfault): stack-buffer-overflow with
                    -fsanitize=undefined
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: burnus at gcc dot gnu.org
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org,
                    mpolacek at gcc dot gnu.org

I run into this with a bigger code and GCC 4.9 r205287 on x86-64-gnu-linux.
Using an about one-week old GCC, it compiled successfully - but now it
segfaults.

I have now created a -fsanitize=address GCC build, which allowed me to reduce
the code (before, I couldn't go smaller than about 64k).

In any case, GCC now fails for:
  cc1plus -fsanitize=undefined
for this 5-line program:

class Parent { };
class RefNameDict : public Parent {
  explicit RefNameDict (bool uniqueNames);
};
RefNameDict::RefNameDict (bool uniqueNames) { }


Address sanitizer prints:

==8820==ERROR: AddressSanitizer: stack-buffer-overflow on address
0x7fffcc257f58 at pc 0x1768edf bp 0x7fffcc257e60 sp 0x7fffcc257e58
WRITE of size 8 at 0x7fffcc257f58 thread T0
    #0 ubsan_create_data(char const*, unsigned int, ubsan_mismatch_data const*,
...) + 2493 in section .text
    #1 ubsan_expand_null_ifn(gimple_stmt_iterator_d) + 2283 in section .text
    #2 execute_sanopt() + 838 in section .text
    #3 (anonymous namespace)::pass_sanopt::execute() + 8 in section .text
...
Address 0x7fffcc257f58 is located in stack of thread T0 at offset 184 in frame
    #0 ubsan_create_data(char const*, unsigned int, ubsan_mismatch_data const*,
...) + 15 in section .text
  This frame has 5 object(s):
    [32, 40) 'saved_args'
    [96, 104) 'v'
    [160, 184) 'fields' <== Memory access at offset 184 overflows this variable
    [224, 248) 'args'
    [288, 320) 'tmp_name'


^ permalink raw reply	[flat|nested] 11+ messages in thread
end of thread, other threads:[~2013-11-26 21:30 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-11-23  0:44 [Bug sanitizer/59258] New: usan: ICE(segfault): stack-buffer-overflow with -fsanitize=undefined burnus at gcc dot gnu.org
2013-11-23 20:38 ` [Bug sanitizer/59258] " burnus at gcc dot gnu.org
2013-11-23 21:03 ` mpolacek at gcc dot gnu.org
2013-11-23 21:34 ` burnus at gcc dot gnu.org
2013-11-23 21:46 ` burnus at gcc dot gnu.org
2013-11-23 23:00 ` mpolacek at gcc dot gnu.org
2013-11-25 11:15 ` mpolacek at gcc dot gnu.org
2013-11-25 16:09 ` [Bug sanitizer/59258] ubsan: " mpolacek at gcc dot gnu.org
2013-11-25 18:51 ` jakub at gcc dot gnu.org
2013-11-26 21:27 ` jakub at gcc dot gnu.org
2013-11-26 21:30 ` jakub at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).