https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110399
Bug ID: 110399
Summary: pointer substraction causes coredump with ftrapv on
edge case
Product: gcc
Version: unknown
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: c
Assignee: unassigned at gcc dot gnu.org
Reporter: baiwfg2 at gmail dot com
Target Milestone: ---
The demo code is :
```c
#include <stdio.h>
#include <stdint.h>
#include <signal.h>
#include <assert.h>
int main() {
{
char *p = (char *)0x80000001;
char *q = (char *)0x7fffffff;
uint32_t w = p - q;
printf("32 bit, w1=%u\n", w);
}
{
char *p = (char *)0x7fffffffffffffff;
char *q = (char *)0x7ffffffffffffffd;
uint32_t w2 = p - q;
printf("w2=%u\n", w2);
}
{
char *p = (char *)0x8000000000000003;
char *q = (char *)0x8000000000000001;
uint32_t w3 = p - q;
printf("w3=%u\n", w3);
}
{
char *p = (char *)0x8000000000000001;
char *q = (char *)0x0000000000000001;
uint32_t w4 = p - q;
printf("w4=%u\n", w4); // ans is 0, not crash under -ftrapv
}
{
char *p = (char *)0x8000000000000001;
char *q = (char *)0x7fffffffffffffff;
uint32_t w5 = (uintptr_t)p - (uintptr_t)q;
printf("w5=%u\n", w5);
}
{
char *p = (char *)0x8000000000000001; // use uint8_t also crash
char *q = (char *)0x7fffffffffffffff; // use smaller num
0x0000000000000011, also crash
uint32_t w6 = p - q;
printf("w6=%u\n", w6); // crash under gcc -ftrapv, not crash under
clang -ftrapv
}
return 0;
}
```
The statement w6 = p - q cause coredump. But what program actually means do
pointer unsigned arithmetic operation. How can I make it right(that is, output
2) with ftrapv option ? I find it's ok with clang -ftrapv .
This happens on many gcc versions.
