Re: Only 23 days left of active development before master freezes.

[David Miller <davem at davemloft dot net>]

From: "Carlos O'Donell" <carlos@redhat.com>
Date: Thu, 18 Dec 2014 15:37:58 -0500

> Do you need help fixing up sparc?

I'm running into problems that look like compiler bugs, for example while
building the dynamic linker code we have, from a CPP pre-processed dl-load.c:

inline void __attribute__ ((unused, always_inline))
elf_get_dynamic_info (struct link_map *l, Elf32_Dyn *temp)
{
  Elf32_Dyn *dyn = l->l_ld;
  Elf32_Dyn **info;
 ...
  info = l->l_info;

  while (dyn->d_tag != 0)
    {
      if ((d_tag_utype) dyn->d_tag < 34)
 info[dyn->d_tag] = dyn;
      else if (dyn->d_tag >= 0x70000000 &&
        dyn->d_tag < 0x70000000 + 2)
 info[dyn->d_tag - 0x70000000 + 34] = dyn;
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

GCC warns about that final expression:

get-dynamic-info.h:50:40: error: array subscript is above array bounds [-Werror=array-bounds]

However, looking at l->l_info's definition:

    Elf32_Dyn *l_info[34 + 2 + 16
        + 3 + 12 + 11];

The expression is certainly protected in a way such that it will be
in-bounds.  The conditional only accepts d_tag values which are either
0x70000000 or 0x70000001.

This means the info[] array index evaluates to either 34 or 35, which
is definitely in the range of the defined array size.

This is with Debian's gcc-4.6.3