https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118248

--- Comment #12 from Stefan Schulze Frielinghaus <stefansf at gcc dot gnu.org> 
---
Confirmed.

Function riscv_block_move_straight() is called to copy 4 bytes. bits equals 64
which means delta equals 8. This in turn renders

regs = XALLOCAVEC (rtx, length / delta - 1);

into an alloca() call with a negative argument which segfaults.

I guess something along the lines is required:

diff --git a/gcc/config/riscv/riscv-string.cc
b/gcc/config/riscv/riscv-string.cc
index 408eb07e87f..8d37cdea114 100644
--- a/gcc/config/riscv/riscv-string.cc
+++ b/gcc/config/riscv/riscv-string.cc
@@ -814,6 +814,8 @@ riscv_block_move_straight (rtx dest, rtx src, unsigned
HOST_WIDE_INT length,

   mode = mode_for_size (bits, MODE_INT, 0).require ();
   delta = bits / BITS_PER_UNIT;
+  if (delta > length)
+    delta = length;

   /* Allocate a buffer for the temporary registers.  */
   regs = XALLOCAVEC (rtx, length / delta - 1);

Reply via email to