https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86259

            Bug ID: 86259
           Summary: min(4, strlen(s)) optimized to strlen(s) with -flto
           Product: gcc
           Version: 8.1.1
            Status: UNCONFIRMED
          Keywords: lto, wrong-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gcc at thecybershadow dot net
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu
             Build: x86_64-pc-linux-gnu

////////////////// test.c /////////////////
#include <stdio.h>
#include <string.h>

#define min(a, b) (((a) < (b)) ? (a) : (b))

char buf[32];

void fun1(char *s)
{
    memcpy(buf, s, min(4, strlen(s)));
    memcpy(buf, s, min(4, strlen(s)));
}

typedef struct
{
    char s[4];
    char s2;
} T;

void fun2(char* s)
{
    T *t = (T *) s;
    fun1(t->s);
}

int main()
{
    fun2("abcdefghijklmnopqrstuvwxyz");
    puts(buf);
    return 0;
}
///////////////////////////////////////////

Gives different results with `gcc test.c` and `gcc -O2 -flto test.c`.

The buffer in the example above fits the entire string in either case, but in
the non-reduced application, this causes a heap buffer overflow.

Can be reproduced with 8.1.1 and current trunk (r261830).

Reply via email to