https://gcc.gnu.org/bugzilla/show_bug.cgi?id=128370
Bug ID: 128370
Summary: ICE: Segmentation fault in check_function_sentinel
with sentinel(0xFFFFFFF0u)
Product: gcc
Version: 16.2.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: c
Assignee: unassigned at gcc dot gnu.org
Reporter: 220245569 at seu dot edu.cn
CC: 220255623 at seu dot edu.cn, jianhao.xu at seu dot edu.cn
Target Milestone: ---
Target: *-*-*
Reproducer
----------
$ cat trigger.c
extern void log_msgs (const char *fmt, ...)
__attribute__((sentinel(0xFFFFFFF0u)));
int main (void)
{
log_msgs ("a", "b", "c");
return 0;
}
Compile flag: x86_64-linux-gnu-gcc -O0 -Wall -c trigger.c
trigger.c: In function 'main':
trigger.c:6:3: internal compiler error: Segmentation fault
6 | log_msgs ("a", "b", "c");
| ^~~~~~~~
0x29ebfe9 crash_signal(int)
gcc/toplev.cc:325
0x18d315e check_function_sentinel(tree_node const*, int, tree_node**)
gcc/c-family/c-common.cc:6000 # out-of-bounds argarray
read
0x18d315e check_function_arguments(...)
gcc/c-family/c-common.cc:6430
# same ICE on aarch64-linux-gnu; without -Wformat/-Wall the file compiles (exit
0)
Root cause
----------
handle_sentinel_attribute (gcc/c-family/c-attribs.cc:6323) rejects the
position only if tree_int_cst_lt (position, integer_zero_node), which honours
the constant's own signedness, so 0xFFFFFFF0u is accepted.
check_function_sentinel (gcc/c-family/c-common.cc:5986) then stores
TREE_INT_CST_LOW into 'int pos', giving -16; the guard
'(nargs - 1 - pos) < len' (:5991) is false and argarray[nargs - 1 - pos]
(:5999-6000) reads far past the 3-element argument array.
Suggested Fix
-------------
Reject positions that do not fit a non-negative int in
handle_sentinel_attribute (e.g. require tree_fits_shwi_p and
0 <= value <= INT_MAX), or compute the check in unsigned HOST_WIDE_INT and
bail out when pos >= nargs.
