re PR middle-end/23484 (__builtin___memcpy_chk miscompilation)

	PR middle-end/23484
	* builtins.c (fold_builtin_memory_chk, fold_builtin_stxcpy_chk,
	fold_builtin_strncpy_chk, fold_builtin_snprintf_chk): If len is
	not constant, but maxlen is, don't set len to maxlen, rather
	set maxlen to len if len is a constant.

	* gcc.c-torture/execute/builtins/pr23484-chk.c: New test.
	* gcc.c-torture/execute/builtins/pr23484-chk-lib.c: New file.

From-SVN: r103594

5 files changed, 89 insertions, 9 deletions

diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index 1a2068f..121c889 100644
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,3 +1,11 @@
+2005-08-29  Jakub Jelinek  <jakub@redhat.com>
+
+	PR middle-end/23484
+	* builtins.c (fold_builtin_memory_chk, fold_builtin_stxcpy_chk,
+	fold_builtin_strncpy_chk, fold_builtin_snprintf_chk): If len is
+	not constant, but maxlen is, don't set len to maxlen, rather
+	set maxlen to len if len is a constant.
+
 2005-08-29  Zdenek Dvorak  <dvorakz@suse.cz>
 
 	PR tree-optimization/23475
diff --git a/gcc/builtins.c b/gcc/builtins.c
index 19d2028..16dfc05 100644
--- a/gcc/builtins.c
+++ b/gcc/builtins.c
@@ -10208,10 +10208,11 @@ fold_builtin_memory_chk (tree fndecl, tree arglist, tree maxlen, bool ignore,
 		}
 	      return 0;
 	    }
-	  len = maxlen;
 	}
+      else
+	maxlen = len;
 
-      if (tree_int_cst_lt (size, len))
+      if (tree_int_cst_lt (size, maxlen))
 	return 0;
     }
 
@@ -10313,10 +10314,11 @@ fold_builtin_stxcpy_chk (tree fndecl, tree arglist, tree maxlen, bool ignore,
 	      return fold_convert (TREE_TYPE (TREE_TYPE (fndecl)),
 				   build_function_call_expr (fn, arglist));
 	    }
-	  len = maxlen;
 	}
-      
-      if (! tree_int_cst_lt (len, size))
+      else
+	maxlen = len;
+
+      if (! tree_int_cst_lt (maxlen, size))
 	return 0;
     }
 
@@ -10361,10 +10363,11 @@ fold_builtin_strncpy_chk (tree arglist, tree maxlen)
 	     if SIZE is >= MAXLEN, never convert to __ocs_fail ().  */
 	  if (maxlen == NULL_TREE || ! host_integerp (maxlen, 1))
 	    return 0;
-	  len = maxlen;
 	}
+      else
+	maxlen = len;
 
-      if (tree_int_cst_lt (size, len))
+      if (tree_int_cst_lt (size, maxlen))
 	return 0;
     }
 
@@ -10630,10 +10633,11 @@ fold_builtin_snprintf_chk (tree arglist, tree maxlen,
 	     if SIZE is >= MAXLEN, never convert to __ocs_fail ().  */
 	  if (maxlen == NULL_TREE || ! host_integerp (maxlen, 1))
 	    return 0;
-	  len = maxlen;
 	}
+      else
+	maxlen = len;
 
-      if (tree_int_cst_lt (size, len))
+      if (tree_int_cst_lt (size, maxlen))
 	return 0;
     }
 
diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 5bc6d18..d4de911 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,9 @@
+2005-08-29  Jakub Jelinek  <jakub@redhat.com>
+
+	PR middle-end/23484
+	* gcc.c-torture/execute/builtins/pr23484-chk.c: New test.
+	* gcc.c-torture/execute/builtins/pr23484-chk-lib.c: New file.
+
 2005-08-29  Andreas Jaeger  <aj@suse.de>
 
 	PR testsuite/23607
diff --git a/gcc/testsuite/gcc.c-torture/execute/builtins/pr23484-chk-lib.c b/gcc/testsuite/gcc.c-torture/execute/builtins/pr23484-chk-lib.c
new file mode 100644
index 0000000..9daf13e
--- /dev/null
+++ b/gcc/testsuite/gcc.c-torture/execute/builtins/pr23484-chk-lib.c
@@ -0,0 +1 @@
+#include "lib/chk.c"
diff --git a/gcc/testsuite/gcc.c-torture/execute/builtins/pr23484-chk.c b/gcc/testsuite/gcc.c-torture/execute/builtins/pr23484-chk.c
new file mode 100644
index 0000000..58d4db4
--- /dev/null
+++ b/gcc/testsuite/gcc.c-torture/execute/builtins/pr23484-chk.c
@@ -0,0 +1,61 @@
+/* PR middle-end/23484 */
+
+extern void abort (void);
+typedef __SIZE_TYPE__ size_t;
+extern size_t strlen (const char *);
+extern void *memcpy (void *, const void *, size_t);
+extern void *mempcpy (void *, const void *, size_t);
+extern void *memmove (void *, const void *, size_t);
+extern int snprintf (char *, size_t, const char *, ...);
+extern int memcmp (const void *, const void *, size_t);
+
+#include "chk.h"
+
+static char data[8] = "ABCDEFG";
+
+int l1;
+
+void
+__attribute__((noinline))
+test1 (void)
+{
+  char buf[8];
+
+  /* All the checking calls in this routine have a maximum length, so
+     object size checking should be done at compile time if optimizing.  */
+  chk_calls = 0;
+
+  memset (buf, 'I', sizeof (buf));
+  if (memcpy (buf, data, l1 ? sizeof (buf) : 4) != buf
+      || memcmp (buf, "ABCDIIII", 8))
+    abort ();
+
+  memset (buf, 'J', sizeof (buf));
+  if (mempcpy (buf, data, l1 ? sizeof (buf) : 4) != buf + 4
+      || memcmp (buf, "ABCDJJJJ", 8))
+    abort ();
+
+  memset (buf, 'K', sizeof (buf));
+  if (memmove (buf, data, l1 ? sizeof (buf) : 4) != buf
+      || memcmp (buf, "ABCDKKKK", 8))
+    abort ();
+
+  memset (buf, 'L', sizeof (buf));
+  if (snprintf (buf, l1 ? sizeof (buf) : 4, "%d", l1 + 65536) != 5
+      || memcmp (buf, "655\0LLLL", 8))
+    abort ();
+
+  if (chk_calls)
+    abort ();
+}
+
+void
+main_test (void)
+{
+#ifndef __OPTIMIZE__
+  /* Object size checking is only intended for -O[s123].  */
+  return;
+#endif
+  __asm ("" : "=r" (l1) : "0" (l1));
+  test1 ();
+}