https://gcc.gnu.org/g:f0d858f11044fd139ce05dbc1ee05a90f01d9eef
commit r17-5536-gf0d858f11044fd139ce05dbc1ee05a90f01d9eef Author: Matt Turner <[email protected]> Date: Sat Oct 24 08:07:07 2026 -0600 [PATCH 1/2] ia64: Make the length in ia64_copy_rbs signed ia64_copy_rbs copies alternating runs of the source and destination backing stores between their NaT collection slots. The second run assumes a source NaT collection follows it, and subtracts that slot from LEN even when the run was cut short because LEN was smaller. If the source ends inside that run, LEN goes 8 bytes below zero. LEN is unsigned, so it wraps instead, "while (len > 0)" keeps going, and the copy runs until it faults. LEN was a long until r185852 changed it to unw_word. Make it unw_sword, and COUNT too, to avoid -Wsign-compare warnings. This can happen with both the current length and the corrected one, so fix it first. libgcc/ChangeLog: * config/ia64/unwind-ia64.c (ia64_copy_rbs): Make LEN and COUNT signed. Diff: --- libgcc/config/ia64/unwind-ia64.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libgcc/config/ia64/unwind-ia64.c b/libgcc/config/ia64/unwind-ia64.c index a45ea8549554..45359a36a168 100644 --- a/libgcc/config/ia64/unwind-ia64.c +++ b/libgcc/config/ia64/unwind-ia64.c @@ -1499,9 +1499,9 @@ ia64_rse_skip_regs (unw_word *addr, int num_regs) at different relative offsets and need to be combined together. */ static void ia64_copy_rbs (struct _Unwind_Context *info, unw_word dst, - unw_word src, unw_word len, unw_word dst_rnat) + unw_word src, unw_sword len, unw_word dst_rnat) { - unw_word count; + unw_sword count; unw_word src_rnat; unw_word shift1, shift2;
