------- Comment #4 from hjl dot tools at gmail dot com 2009-01-18 17:05 ------- bash-3.2$ cat /tmp/x.c extern void abort (); int foo (const char *, const char *); void bar (void) { char buffer[1024]=""; __builtin_strcpy (buffer, "1234567890abcdefghijklmno"); if (foo (buffer, "1234567890abcdefghijklmno")) abort (); } bash-3.2$ cat /tmp/y.c int foo (const char *x , const char * y) { return __builtin_strcmp (x, y); } extern void bar (void); int main () { bar (); return 0; } bash-3.2$ ./xgcc -B./ -O2 -m32 -O2 -fstack-protector /tmp/x.c -c bash-3.2$ ./xgcc -B./ -m32 /tmp/y.c -c bash-3.2$ ./xgcc -B./ -m32 x.o y.o bash-3.2$ ./a.out Aborted bash-3.2$ ./xgcc -B./ -O2 -m32 -O2 -fstack-protector /tmp/x.c -S bash-3.2$ cat x.s .file "x.c" .section .rodata.str1.1,"aMS",@progbits,1 .LC0: .string "1234567890abcdefghijklmno" .text .p2align 4,,15 .globl bar .type bar, @function bar: pushl %ebp movl $255, %ecx movl %esp, %ebp pushl %edi subl $1060, %esp movl %gs:20, %eax movl %eax, -8(%ebp) xorl %eax, %eax leal -1028(%ebp), %edi movl $875770417, -1032(%ebp) movl $1650536505, -1024(%ebp) movl $1717920867, -1020(%ebp) movl $1785292903, -1016(%ebp) movl $1852664939, -1012(%ebp) rep stosl <<<<<<< Wrong place leal -1032(%ebp), %eax movl $943142453, -1028(%ebp) movw $111, -1008(%ebp) movl $.LC0, 4(%esp) movl %eax, (%esp) call foo testl %eax, %eax jne .L7 movl -8(%ebp), %eax xorl %gs:20, %eax jne .L8 addl $1060, %esp popl %edi popl %ebp .p2align 4,,3 .p2align 3 ret .L7: .p2align 4,,6 .p2align 3 call abort .L8: .p2align 4,,5 .p2align 3 call __stack_chk_fail .size bar, .-bar
-- http://gcc.gnu.org/bugzilla/show_bug.cgi?id=38902