[Bug gcov-profile/97069] New: Zero valued #line directive results in excessively large blocks of memory being allocated

[Bug gcov-profile/97069] New: Zero valued #line directive results in excessively large blocks of memory being allocated

[martin.ogden at arm dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97069

            Bug ID: 97069
           Summary: Zero valued #line directive results in excessively
                    large blocks of memory being allocated
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: gcov-profile
          Assignee: unassigned at gcc dot gnu.org
          Reporter: martin.ogden at arm dot com
                CC: marxin at gcc dot gnu.org
  Target Milestone: ---

Created attachment 49225
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=49225&action=edit
Associated main.i file

Adding a #line directive with a line number of 0 causes gcov to attempt to
allocate large (~2G) blocks of memory. To reproduce, consider main.c:

    int main()
    {
    }

    #line 0 "main.c"
    void zero_line_directive()
    {
    }

Compile and attempt to run gcov:

    $ gcc main.c -Wall -Werror --coverage
    $ ./a.out
    $ gcov main.c # gcov a-main.c for gcc-11
    terminate called after throwing an instance of 'std::bad_alloc'
    what():  std::bad_alloc

The bad allocation is made in gcc/gcc/gcov.c at line 1346:

    s->lines.resize(last_line + 1);

A line number of 0 causes `last_line` to be large (often 0x100000, sometimes
larger ~10^8).


System details
--------------

Fault occurs on Ubuntu 16.04.6 with with gcc-{5,7,8,9,11} and gcov-{5,7,8,9,11}
(not tested with v{<=4,6,10}).

    $ lsb_release -a
    ...
    Distributor ID: Ubuntu
    Description:    Ubuntu 16.04.6 LTS
    Release:        16.04
    Codename:       xenial

    $ gcc -v
    gcc version 11.0.0 20200902 (experimental) (GCC)

    $ gcc-9 -v
    gcc-9 (Ubuntu 9.3.0-10ubuntu2~16.04) 9.3.0

    $ gcc-8
    gcc-8 (Ubuntu 8.1.0-9ubuntu1~16.04.york1) 8.1.0

    $ gcc-7 -v
    gcc-7 (Ubuntu 7.3.0-23ubuntu2~16.04.york0) 7.3.0

    $ gcc-5 -v
    gcc-5 (Ubuntu 5.5.0-12ubuntu1~16.04) 5.5.0 20171010

It also occurs on macOS 10.15.6 with gcc-{7,8,9} (not tested with
v{<=5,6,10,11}).

[Bug gcov-profile/97069] Zero valued #line directive results in excessively large blocks of memory being allocated

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97069

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Any reason why you want #line 0 ?  Files don't really have line number 0...

[Bug gcov-profile/97069] Zero valued #line directive results in excessively large blocks of memory being allocated

[martin.ogden at arm dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97069

--- Comment #2 from Martin Ogden <martin.ogden at arm dot com> ---
I appreciate `#line 0 "main.c"` doesn't make much sense, but according to
https://gcc.gnu.org/onlinedocs/cpp/Line-Control.html, 0 is a valid input.

[Bug gcov-profile/97069] Zero valued #line directive results in excessively large blocks of memory being allocated

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97069

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2020-09-21
           Assignee|unassigned at gcc dot gnu.org      |marxin at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Let me take it.

[Bug gcov-profile/97069] Zero valued #line directive results in excessively large blocks of memory being allocated

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97069

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Liska <marxin@gcc.gnu.org>:

https://gcc.gnu.org/g:6b4e8bf88f1172ce8561f57b12fb81063b21a78f

commit r11-3384-g6b4e8bf88f1172ce8561f57b12fb81063b21a78f
Author: Martin Liska <mliska@suse.cz>
Date:   Mon Sep 21 16:26:10 2020 +0200

    gcov: fix streaming corruption

    gcc/ChangeLog:

            PR gcov-profile/97069
            * profile.c (branch_prob): Line number must be at least 1.

    gcc/testsuite/ChangeLog:

            PR gcov-profile/97069
            * g++.dg/gcov/pr97069.C: New test.

[Bug gcov-profile/97069] Zero valued #line directive results in excessively large blocks of memory being allocated

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97069

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |11.0
      Known to fail|                            |10.2.0

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
Fixed on master so far.

[Bug gcov-profile/97069] Zero valued #line directive results in excessively large blocks of memory being allocated

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97069

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Martin Liska
<marxin@gcc.gnu.org>:

https://gcc.gnu.org/g:bc3914f307211c42f31af7e64d2e6cc8a69837cb

commit r10-8838-gbc3914f307211c42f31af7e64d2e6cc8a69837cb
Author: Martin Liska <mliska@suse.cz>
Date:   Mon Sep 21 16:26:10 2020 +0200

    gcov: fix streaming corruption

    gcc/ChangeLog:

            PR gcov-profile/97069
            * profile.c (branch_prob): Line number must be at least 1.

    gcc/testsuite/ChangeLog:

            PR gcov-profile/97069
            * g++.dg/gcov/pr97069.C: New test.

    (cherry picked from commit 6b4e8bf88f1172ce8561f57b12fb81063b21a78f)

[Bug gcov-profile/97069] Zero valued #line directive results in excessively large blocks of memory being allocated

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97069

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Martin Liska
<marxin@gcc.gnu.org>:

https://gcc.gnu.org/g:20f699a44492f2f43351d19849873d1112ffc7e0

commit r9-8967-g20f699a44492f2f43351d19849873d1112ffc7e0
Author: Martin Liska <mliska@suse.cz>
Date:   Mon Sep 21 16:26:10 2020 +0200

    gcov: fix streaming corruption

    gcc/ChangeLog:

            PR gcov-profile/97069
            * profile.c (branch_prob): Line number must be at least 1.

    gcc/testsuite/ChangeLog:

            PR gcov-profile/97069
            * g++.dg/gcov/pr97069.C: New test.

    (cherry picked from commit 6b4e8bf88f1172ce8561f57b12fb81063b21a78f)

[Bug gcov-profile/97069] Zero valued #line directive results in excessively large blocks of memory being allocated

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97069

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Martin Liška <marxin at gcc dot gnu.org> ---
Resolved.