Bug 754730

Summary: GCC optimization hiding NULL-dereference bug
Product: [Fedora] Fedora Reporter: Stephen Gallagher <sgallagh>
Component: gccAssignee: Jakub Jelinek <jakub>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 16CC: dpal, jakub
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 754729 Environment:
Last Closed: 2011-11-24 11:16:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 754729    
Bug Blocks:    
Attachments:
Description Flags
Sample program demonstrating the issue none

Description Stephen Gallagher 2011-11-17 15:16:28 UTC 
+++ This bug was initially created as a clone of Bug #754729 +++

Description of problem:
GCC optimization at level -O1 or higher hides a NULL-dereference bug in an 'if' statement.

Version-Release number of selected component (if applicable):
gcc-4.6.2-1.fc16.x86_64

How reproducible:
Every time.

Steps to Reproduce:
1. Compile the attached sample program with -O1, -O2 or -O3
  
Actual results:
Program runs to completion, returning success.

Expected results:
Program should crash due to a segmentation fault attempting to dereference 'ptr' in the IF statement.


Additional info:
If the attached program is built with -O0, the crash does not occur (and may hang around to cause unrelated issues later that are more difficult to track down).
Comment 1 Stephen Gallagher 2011-11-17 15:17:46 UTC 
Created attachment 534209 [details]
Sample program demonstrating the issue
Comment 2 Jakub Jelinek 2011-11-24 11:16:26 UTC 
That is fine, dereferencing a NULL pointer results in undefined behavior, when you reach such a statement the program can do anything, format your disk, segfault, anything else, and the compiler may optimize based on the assumption that it doesn't happen.