Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 290097 - sys-libs/libsmbios breaks on -O3 "error: array subscript is above array bounds"
Summary: sys-libs/libsmbios breaks on -O3 "error: array subscript is above array bounds"
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: New packages (show other bugs)
Hardware: All Linux
: High normal
Assignee: Cédric Krier
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-10-22 05:25 UTC by Roger
Modified: 2010-02-11 23:42 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
build.log (build.log,91.30 KB, text/plain)
2009-10-22 22:55 UTC, Roger
Details
Simplified build.log without distcc (and ccache) (build-2.2.16.log,90.81 KB, text/plain)
2009-10-23 16:40 UTC, Roger
Details
reduced testcase (testcase.c,1.43 KB, text/plain)
2009-10-23 21:06 UTC, Sebastian Luther (few)
Details
more reduced testcase (testcase.c,390 bytes, text/plain)
2009-10-23 21:27 UTC, Sebastian Luther (few)
Details
build-2.2.19.log (build-2.2.19.log,1.56 KB, text/plain)
2009-11-22 00:24 UTC, Roger
Details
Another testcase (gcc-array-bounds.c,638 bytes, text/plain)
2010-01-12 09:08 UTC, Petr Zima
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Roger 2009-10-22 05:25:18 UTC
sys-libs/libsmbios requires cflags unset else the compile will fail.


Reproducible: Always

Actual Results:  
Sorry.  I don't have a saved clipping of the compiler error.  Just know it will fail with the following cflags:

CFLAGS="-march=pentium3 -O3 -pipe -fomit-frame-pointer"

I think most low-level coding does require cflags unset, ie grub, in order to compile and execute safely.  (Grub will compile, but will hang during execution.)
Comment 1 Rafał Mużyło 2009-10-22 15:01:12 UTC
OK, attach build.log then.
Comment 2 Patrick Lauer gentoo-dev 2009-10-22 20:24:13 UTC
Cannot reproduce
Comment 3 Roger 2009-10-22 22:55:04 UTC
Created attachment 207949 [details]
build.log

-j2 is enabled along with:

CFLAGS="-march=pentium3 -O3 -pipe -fomit-frame-pointer"
CXXFLAGS="${CFLAGS}"
LDFLAGS="-Wl,-O1"
Comment 4 Roger 2009-10-22 22:57:13 UTC
Reopening bug.

I've got a minute or so and will try building w/o a few optimizations to see if it's just a trivial thing.
Comment 5 Roger 2009-10-23 00:41:15 UTC
So far, it seems to be the -O3 breaking the compile.  Reducing to -O2, the compile completes.
Comment 6 Sebastian Luther (few) 2009-10-23 10:16:35 UTC
Try again without distcc and attach the new build.log (if it still fails) and provide emerge --info.
Comment 7 Roger 2009-10-23 16:40:27 UTC
Created attachment 208010 [details]
Simplified build.log without distcc (and ccache)

Comment #6 doesn't make sense.

But for kicks, I compiled without cccache/distcc anyways as I forgot what the error was, and had another package complaining (with a diff error output -- but had to disable distcc anyways).
Comment 8 Sebastian Luther (few) 2009-10-23 16:55:19 UTC
(In reply to comment #7)
> Created an attachment (id=208010) [details]
> Simplified build.log without distcc (and ccache)
> 
> Comment #6 doesn't make sense.
> 
> But for kicks, I compiled without cccache/distcc anyways as I forgot what the
> error was, and had another package complaining (with a diff error output -- but
> had to disable distcc anyways).
> 

Before stating that a comment doesn't make sense, you should first properly read it. If you would have done so, you would have attached emerge --info and we would, among other things, know what compiler version you are using.
Comment 9 Roger 2009-10-23 16:58:56 UTC
If you read the compiler output, you'll see this is a simple array issue and the compile is simply instructed to stop on all warnings.

This is usually caused by a cflag designating all warnings to be treated like errors.  I usually only enable such flags when I want to tackle all warnings within my code.

There's also a pre-packaged binary within this ebuild source package:
  /var/tmp/portage/.../work/libsmbios-2.2.16/pkg/py-compile


I'm marking this as works for me.  Feel free to reopen if you want to fix it.
Comment 10 Roger 2009-10-23 17:00:24 UTC
Using built-in specs.
Target: i686-pc-linux-gnu
Configured with: /var/tmp/portage/sys-devel/gcc-4.3.4/work/gcc-4.3.4/configure --prefix=/usr --bindir=/usr/i686-pc-linux-gnu/gcc-bin/4.3.4 --includedir=/usr/lib/gcc/i686-pc-linux-gnu/4.3.4/include --datadir=/usr/share/gcc-data/i686-pc-linux-gnu/4.3.4 --mandir=/usr/share/gcc-data/i686-pc-linux-gnu/4.3.4/man --infodir=/usr/share/gcc-data/i686-pc-linux-gnu/4.3.4/info --with-gxx-include-dir=/usr/lib/gcc/i686-pc-linux-gnu/4.3.4/include/g++-v4 --host=i686-pc-linux-gnu --build=i686-pc-linux-gnu --disable-altivec --disable-fixed-point --enable-nls --without-included-gettext --with-system-zlib --disable-checking --disable-werror --enable-secureplt --disable-multilib --enable-libmudflap --disable-libssp --enable-libgomp --disable-libgcj --with-arch=i686 --enable-languages=c,c++,treelang,fortran --enable-shared --enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu --with-bugurl=http://bugs.gentoo.org/ --with-pkgversion='Gentoo 4.3.4 p1.0, pie-10.1.5'
Thread model: posix
gcc version 4.3.4 (Gentoo 4.3.4 p1.0, pie-10.1.5)
Comment 11 Sebastian Luther (few) 2009-10-23 17:01:37 UTC
You said in comment 5 that it depends on the optimization level. This shouldn't be the case.
Comment 12 Samuli Suominen (RETIRED) gentoo-dev 2009-10-23 19:21:17 UTC
(In reply to comment #5)
> So far, it seems to be the -O3 breaking the compile.  Reducing to -O2, the
> compile completes.
> 

That's only part of the required information. You have to find the flag that's breaking it. It's simple, use "man gcc" as reference to see what's different between -O2 and -O3 optimization levels. Then use -O2 and add those flags,
drop them until you find the offending one.
Comment 13 Sebastian Luther (few) 2009-10-23 20:36:47 UTC
I reproduced it on amd64 with gcc-4.4.2. The fun thing is that the warning disappears when "-O2 + all options that are enabled with -O3"* is used.

* -finline-functions -funswitch-loops -fpredictive-commoning -fgcse-after-reload -ftree-vectorize
Comment 14 Sebastian Luther (few) 2009-10-23 21:06:12 UTC
Created attachment 208063 [details]
reduced testcase

gcc-4.4.2 -O2 -std=gnu99 -Wall -c testcase.c
-> no warning

gcc-4.4.2 -O3 -std=gnu99 -Wall -c testcase.c
-> testcase.c:30: warning: array subscript is above array bounds

gcc-4.4.2 -O2 -std=gnu99 -Wall -c testcase.c -finline-functions -funswitch-loops -fpredictive-commoning -fgcse-after-reload -ftree-vectorize
-> no warning
Comment 15 Sebastian Luther (few) 2009-10-23 21:27:14 UTC
Created attachment 208065 [details]
more reduced testcase

Compile with the same options as above. The warning can be triggered with -O2, if in line 6 the size of the array is lowered.
Comment 16 Ryan Hill (RETIRED) gentoo-dev 2009-10-23 23:12:03 UTC
the bug here is that libsmbios is built with -Werror, which has nothing to do with toolchain.

i still don't see emerge --info.
Comment 17 Roger 2009-10-24 05:55:40 UTC
In ref to  Comment  #13.  Ditto.  I was also trying to view extended flags of -O? levels, but for some reason forgot how.

Ditto concerning -Werror being set. I'm seeing it set within the Makefile.am & Makefile.in

Of all likeliness, the reason Werror is set is likely because libsmbios binaries touches BIOS level code and is there to ensure the binaries created will be executing functions properly on the BIOS level code.

Since I've had my Dell laptop, I don't think I've ever really used this package.  The Service Tag ID is already provided in /proc by the in kernel I8K module.  As such, libsmbios is kind of useless here.  It's suppose to modify back light settings, etc.

The only packaging seemingly requiring it is hal with use flag "dell". (ie. euses dell)  Even then, it still doesn't appear to be needed on dell laptops(?)

I'm in the midst of emerge system/world after a GCC upgrade -- thought I'd take the time to at least file.

Simply unsetting the flags via a /etc/portage/env/sys-libs/libsmbios file resolves it here.

Another hack that could be quickly performed if none of you use this package too, is use "strip-flags" to strip cflags within the ebuild and maybe post a warning pointing to this bug. (Mplayer's ebuild does this already.)
Comment 18 SpanKY gentoo-dev 2009-10-24 06:02:22 UTC
ignoring the -Werror, the code too is wrong (and the warning is correct)

the reduced test case *is* exceeding the proper bounds.  that struct is not packed which means you have 5 bytes of valid data followed by 1 padding byte followed by 2 bytes of valid data.

however, still ignoring that buglet and the behavior of gcc is debatable.  it will warn as soon as you exceed the array.  you might be able to open a report upstream about that.
Comment 19 Roger 2009-10-24 07:01:57 UTC
Ditto Spanky.  I'm in the process of signing up and posting this issue on Dell's libsmbios mailing list.

However, it appears there's been no newer releases of libsmbios since 2006.  And the last reply on their mailing list from a Dell rep is July 2008. <shrugs>

This bug is a duplicate of Bug #272128 and has a status of "RESOLVED NEEDINFO"

Last comment was, "increase the array ptr or to substitute
sizeof something more suitable"

I'll forward this upstream / post on their mailing list.
Comment 20 Roger 2009-10-24 07:11:30 UTC
Bug has been filed on Dell's libsmbios-devel mailing list and should show within October's archives (dated specifically, 2009.10.23).

 http://lists.us.dell.com/pipermail/libsmbios-devel/
Comment 21 Sebastian Luther (few) 2009-10-24 18:36:57 UTC
(In reply to comment #18)
> the reduced test case *is* exceeding the proper bounds.  that struct is not
> packed which means you have 5 bytes of valid data followed by 1 padding byte
> followed by 2 bytes of valid data.
> 

I should add that the original struct is defined as

struct dmi_table_entry_point
{
    u8 anchor[5];
    u8 checksum;
    u16 table_length;
    u32 table_address;
    u16 table_num_structs;
    u8 smbios_bcd_revision;
}
__attribute__ ((packed));
Comment 22 Cédric Krier gentoo-dev 2009-11-21 19:20:41 UTC
Could you try with 2.2.19?
Comment 23 Dror Levin (RETIRED) gentoo-dev 2009-11-21 22:02:56 UTC
(In reply to comment #22)
> Could you try with 2.2.19?

Fails for me with -O3 on ~amd64 using gcc-4.4.2.
Comment 24 Roger 2009-11-22 00:24:54 UTC
Created attachment 210828 [details]
build-2.2.19.log

Still fails to build with -O3.

(Still compiles fine with -O2)
Comment 25 Roger 2009-11-22 00:26:32 UTC
Absolutely still no activity from libsmbios mailing list or developers (after I reported this upstream).
Comment 26 Roger 2009-12-10 03:15:43 UTC
Ah.  We have activity on the Dell smbios mailing list.
http://lists.us.dell.com/pipermail/libsmbios-devel/2009-December/000461.html

The following is a quoted response:

--- Begin of Snip ---
Analyzing this code, I can only come to the conclusion that this is a completely bogus error.

The code:

    u8 checksum = 0;
    const u8 *ptr = (const u8*)(dmiTEP);
    // don't overrun dmiTEP if BIOS is buggy... (note sizeof() test here)
    //      added especially to deal with buggy Intel BIOS.
    for( unsigned int i = 0; i < sizeof(*dmiTEP); ++i )
        // stupid stuff to avoid MVC++ .NET runtime exception check for cast to different size
        checksum = (checksum + ptr[i]) & 0xFF;

The last line is what gives the warning.

The 'ptr[i]' line is guaranteed to never overflow due to the sizeof() check in the for() loop.

I've done some searches, but am not able to determine a way to change the code to supress this warning. My advice is "dont do that". I only recommend -O2 compilation, which I believe is the default.
-- 
Michael

--- End of Snip ---
Comment 27 Cédric Krier gentoo-dev 2009-12-25 10:08:03 UTC
Fix in CVS
Comment 28 Samuli Suominen (RETIRED) gentoo-dev 2009-12-25 11:16:13 UTC
And what happens when the offending flag from -O3 is moved to -O2 at some point? This isn't solved by replacing -O3 with -O2. The offending flag might as well be in -Os far as we know, since it hasn't been pinpointed to any particular flag here. When it has, the ebuild could have valid workaround as append-flags -fno-something.
Comment 29 Petr Zima 2010-01-12 09:08:17 UTC
Created attachment 216165 [details]
Another testcase

Here is my, very similar testcase. It have tested it with different gcc versions (including lateset ~x86) and with same results. Despite the original libsmbios compiles fine with -O2, this reduced testcase issues warning even with -O2!!! Moreover the "packed" attribute has no influence its behaviour. Summing up: -O0 and -O1 compile fine, -O2 and -O3 issue warning. See comments in the testcase for details.
IMHO it is definitely a gcc bug. This bug should be reopened and/or new gcc bug should be opened.
Comment 30 Roger 2010-02-11 23:42:20 UTC
FYI: libsmbios is now available by git.  See recent libsmbios mailing list (dell.com) post? for further info, or dell.com's libsmbios project webpage.