diff mbox series

xtensa: Fix out-of-bounds array access

Message ID 9871cd37-f2da-ad03-3083-22ff70422ddc@yahoo.co.jp
State Committed
Commit f896c13489d22b30d01257bc8316ab97b3359d1c
Headers
Series xtensa: Fix out-of-bounds array access |

Commit Message

Takayuki 'January June' Suwa Oct. 26, 2022, 6:27 a.m. UTC 
  On 2022/10/26 5:09, Jan-Benedict Glaw wrote:
> I didn't yet actually check the warning, it may be bogus.

This "problem" can occur in the following two places calling xtensa_split_DI_reg_imm():

- (define_expand "movdi") @ line 943-945
- (define_split) @ line 989

and the former causes the "real" problem:

[from gcc/insn-emit.cc (generated by building)]

> /* ../../gcc/config/xtensa/xtensa.md:932 */
> rtx
> gen_movdi (rtx operand0,
> 	rtx operand1)
> {
>   rtx_insn *_val = 0;
>   start_sequence ();
>   {
>     rtx operands[2];					// only 2 elements
>     operands[0] = operand0;
>     operands[1] = operand1;
> #define FAIL return (end_sequence (), _val)
> #define DONE return (_val = get_insns (), end_sequence (), _val)
> #line 936 "../../gcc/config/xtensa/xtensa.md"
> {
>   if (CONSTANT_P (operands[1]))
>     {
>       /* Split in halves if 64-bit Const-to-Reg moves
> 	 because of offering further optimization opportunities.  */
>       if (register_operand (operands[0], DImode))
> 	{
> 	  xtensa_split_DI_reg_imm (operands);		// out-of-bounds!
> 	  emit_move_insn (operands[0], operands[1]);
> 	  emit_move_insn (operands[2], operands[3]);	// out-of-bounds!
> 	  DONE;
> 	}

The latter is not a problem as the array is large enough (up to MAX_RECOG_OPERANDS-1).

===

gcc/ChangeLog:

	* config/xtensa/xtensa.md (movdi):
	Copy operands[0...1] to ops[0...3] and then use the latter before
	calling xtensa_split_DI_reg_imm() and emitting insns.
---
 gcc/config/xtensa/xtensa.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

Comments

Max Filippov Oct. 26, 2022, 5:05 p.m. UTC | #1 
On Tue, Oct 25, 2022 at 11:27 PM Takayuki 'January June' Suwa
<jjsuwa_sys3175@yahoo.co.jp> wrote:
>
> On 2022/10/26 5:09, Jan-Benedict Glaw wrote:
> > I didn't yet actually check the warning, it may be bogus.
>
> This "problem" can occur in the following two places calling xtensa_split_DI_reg_imm():
>
> - (define_expand "movdi") @ line 943-945
> - (define_split) @ line 989
>
> and the former causes the "real" problem:
>
> [from gcc/insn-emit.cc (generated by building)]
>
> > /* ../../gcc/config/xtensa/xtensa.md:932 */
> > rtx
> > gen_movdi (rtx operand0,
> >       rtx operand1)
> > {
> >   rtx_insn *_val = 0;
> >   start_sequence ();
> >   {
> >     rtx operands[2];                                  // only 2 elements
> >     operands[0] = operand0;
> >     operands[1] = operand1;
> > #define FAIL return (end_sequence (), _val)
> > #define DONE return (_val = get_insns (), end_sequence (), _val)
> > #line 936 "../../gcc/config/xtensa/xtensa.md"
> > {
> >   if (CONSTANT_P (operands[1]))
> >     {
> >       /* Split in halves if 64-bit Const-to-Reg moves
> >        because of offering further optimization opportunities.  */
> >       if (register_operand (operands[0], DImode))
> >       {
> >         xtensa_split_DI_reg_imm (operands);           // out-of-bounds!
> >         emit_move_insn (operands[0], operands[1]);
> >         emit_move_insn (operands[2], operands[3]);    // out-of-bounds!
> >         DONE;
> >       }
>
> The latter is not a problem as the array is large enough (up to MAX_RECOG_OPERANDS-1).
>
> ===
>
> gcc/ChangeLog:
>
>         * config/xtensa/xtensa.md (movdi):
>         Copy operands[0...1] to ops[0...3] and then use the latter before
>         calling xtensa_split_DI_reg_imm() and emitting insns.
> ---
>  gcc/config/xtensa/xtensa.md | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)

Committed to master as obvious after cleaning up
the commit message.
diff mbox series

Patch

diff --git a/gcc/config/xtensa/xtensa.md b/gcc/config/xtensa/xtensa.md
index 2e7f76ada5c..de9bcbf24f7 100644
--- a/gcc/config/xtensa/xtensa.md
+++ b/gcc/config/xtensa/xtensa.md
@@ -940,9 +940,10 @@ 
 	 because of offering further optimization opportunities.  */
       if (register_operand (operands[0], DImode))
 	{
-	  xtensa_split_DI_reg_imm (operands);
-	  emit_move_insn (operands[0], operands[1]);
-	  emit_move_insn (operands[2], operands[3]);
+	  rtx ops[4] = { operands[0], operands[1] };
+	  xtensa_split_DI_reg_imm (ops);
+	  emit_move_insn (ops[0], ops[1]);
+	  emit_move_insn (ops[2], ops[3]);
 	  DONE;
 	}