Re: [PATCH] xtensa: Fix out-of-bounds array access

[Max Filippov <jcmvbkbc@gmail.com>]

On Tue, Oct 25, 2022 at 11:27 PM Takayuki 'January June' Suwa
<jjsuwa_sys3175@yahoo.co.jp> wrote:
>
> On 2022/10/26 5:09, Jan-Benedict Glaw wrote:
> > I didn't yet actually check the warning, it may be bogus.
>
> This "problem" can occur in the following two places calling xtensa_split_DI_reg_imm():
>
> - (define_expand "movdi") @ line 943-945
> - (define_split) @ line 989
>
> and the former causes the "real" problem:
>
> [from gcc/insn-emit.cc (generated by building)]
>
> > /* ../../gcc/config/xtensa/xtensa.md:932 */
> > rtx
> > gen_movdi (rtx operand0,
> >       rtx operand1)
> > {
> >   rtx_insn *_val = 0;
> >   start_sequence ();
> >   {
> >     rtx operands[2];                                  // only 2 elements
> >     operands[0] = operand0;
> >     operands[1] = operand1;
> > #define FAIL return (end_sequence (), _val)
> > #define DONE return (_val = get_insns (), end_sequence (), _val)
> > #line 936 "../../gcc/config/xtensa/xtensa.md"
> > {
> >   if (CONSTANT_P (operands[1]))
> >     {
> >       /* Split in halves if 64-bit Const-to-Reg moves
> >        because of offering further optimization opportunities.  */
> >       if (register_operand (operands[0], DImode))
> >       {
> >         xtensa_split_DI_reg_imm (operands);           // out-of-bounds!
> >         emit_move_insn (operands[0], operands[1]);
> >         emit_move_insn (operands[2], operands[3]);    // out-of-bounds!
> >         DONE;
> >       }
>
> The latter is not a problem as the array is large enough (up to MAX_RECOG_OPERANDS-1).
>
> ===
>
> gcc/ChangeLog:
>
>         * config/xtensa/xtensa.md (movdi):
>         Copy operands[0...1] to ops[0...3] and then use the latter before
>         calling xtensa_split_DI_reg_imm() and emitting insns.
> ---
>  gcc/config/xtensa/xtensa.md | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)

Committed to master as obvious after cleaning up
the commit message.

-- 
Thanks.
-- Max