Bug 754729

Summary:

GCC optimization hiding NULL-dereference bug

Product:

Red Hat Enterprise Linux 6

Reporter:

Stephen Gallagher <sgallagh>

Component:

gcc

Assignee:

Jakub Jelinek <jakub>

Status:

CLOSED NOTABUG

QA Contact:

qe-baseos-tools-bugs

Severity:

unspecified

Docs Contact:

Priority:

unspecified

Version:

6.4

CC:

dpal, syeghiay

Target Milestone:

Target Release:

---

Hardware:

Unspecified

OS:

Unspecified

Whiteboard:

Fixed In Version:

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Clones:

754730 (view as bug list)

Environment:

Last Closed:

2011-11-24 11:17:23 UTC

Type:

---

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Bug Depends On:

Bug Blocks:

754730

Attachments:

Description	Flags
Sample program demonstrating the issue	none

Description Stephen Gallagher 2011-11-17 15:15:24 UTC

Description of problem:
GCC optimization at level -O1 or higher hides a NULL-dereference bug in an 'if' statement.

Version-Release number of selected component (if applicable):
gcc-4.4.5-6.el6.x86_64 and gcc-4.6.2-1.fc16.x86_64

How reproducible:
Every time.

Steps to Reproduce:
1. Compile the attached sample program with -O1, -O2 or -O3
  
Actual results:
Program runs to completion, returning success.

Expected results:
Program should crash due to a segmentation fault attempting to dereference 'ptr' in the IF statement.


Additional info:
If the attached program is built with -O0, the crash does not occur (and may hang around to cause unrelated issues later that are more difficult to track down).

Comment 1 Stephen Gallagher 2011-11-17 15:18:09 UTC

Created attachment 534210 [details]
Sample program demonstrating the issue

Comment 4 Jakub Jelinek 2011-11-24 11:17:23 UTC

That is fine, dereferencing a NULL pointer results in undefined behavior, when you reach such a statement the program can do anything, format your disk, segfault, anything else, and the compiler may optimize based on the assumption that it doesn't happen.