I discovered an out of bound access in reload.c, which can happen under
certain conditions (bug 18877).

The problem is, that in decompose (reload.c) assumes, that true_regnum
returns only value < 0 for pseudo registers, which is in certain 
situations not true (all available register in use and a "=&rm" constraint
is still in a pseudo register).

The fix is quite simple and was included in the bug report about 4 month ago.
I raised also this issue on gcc-patches 
(http://gcc.gnu.org/ml/gcc-patches/2004-12/msg01390.html),
but the problem still remains in the mainline cvs version.

It can be used to cause a segmentation fault:
Try http://www.auto.tuwien.ac.at/~mkoegler/gcc/t2.c.gz,
it is gziped, because it is about 300k uncompressed(1k compressed).
I tested it with GNU C version 4.1.0 20050416 (experimental) 
(i686-pc-linux-gnu).

Under normal conditions, the bug will cause, that an arbitrary memory
value is used as register count. In my test case, the 
asm volatile("#":"=r"(l1):"r"(l1));
cause, that the pseudo register number of l2 gets so high,
that this memory access will result in a crash.

What can I do, to get the fix in the CVS?

mfg Martin Kögler
[EMAIL PROTECTED]

Reply via email to