On Mon, Jun 19, 2006 at 02:20:36PM +0200, [EMAIL PROTECTED] wrote:
> On Mon, Jun 19, 2006 at 09:13:15PM +0900, YONETANI Tomokazu wrote:
> > I have almost zero knowledge of how stack protector works, but
> > does it only care about char array of size greater than 8 bytes
> > (8 bytes was ok)? I also tried int[] and double[], but none of them
> > did it.
>
> Hm. Could be a bug in the reordering done for character arrays only.
> If you can create a smaller testcase, we can bug Etoh about it :-)
Done. It's very hard to narrow down when gdb lies to me :)
(attached)
/*
* SSP tickler
*
* expected results(says "OK")
* gcc -W -Wall -pipe -O -march=i586 ssp.c && ./a.out
* gcc -W -Wall -pipe -O2 ssp.c && ./a.out
* gcc -W -Wall -pipe -O2 -fno-stack-protector -march=i586 ssp.c && ./a.out
* (bug untriggered without SSP)
* gcc -W -Wall -pipe -O3 -march=i586 ssp.c && ./a.out
* (baz[] optimized out?)
*
* unexpected results(says "NG")
* gcc -W -Wall -pipe -Os -fstack-protector -march=i586 ssp.c && ./a.out
* gcc -W -Wall -pipe -O2 -fstack-protector -march=i586 ssp.c && ./a.out
*
* NOTES
* - tested on the following compiler:
* gcc 3.4.5 20050809 (prelease) [DragonFly] (propolice, visibility)
* - only -Os and -O2 give you unexpected result.
* - -march or -mtune set to pentium or better is affected.
* - -fno-strict-aliasing has no effect on the result.
*/
#include <stdio.h>
int foo;
int true_expr = 1;
static int
bar(void *p)
{
char baz[9];
int val = 1;
/* just to quiet gcc, no effects on the result */
(void)baz; (void)val;
if (true_expr && !p)
p = &foo;
if (true_expr && !p)
return 1;
else
return 0;
}
int
main(void)
{
printf("%s\n", bar(NULL) ? "NG" : "OK");
return 0;
}
