[Tinycc-devel] Re: Memory bug in tcc

[Cristian Cadar]

  Hello, I'd like to report a bug in the latest version of tcc (0.9.24)
that we found using an automated tool being developed in our group.
  The error is at tcc.c:3801.  The first time execution reaches this
line, the index c into array isidnum_table has value -1, thus accessing
data outside the intended buffer isidnum_table.  I assume the while loop
should be changed to while (c != -1 && isidnum_table[c]), but I didn't
have time to examine the code in much detail.  Here is the output of a
gdb session that shows the bug:

$ gdb ./tcc 
...
(gdb) b tcc.c:3801
Breakpoint 1 at 0x80582f0: file tcc.c, line 3801.
(gdb) r
...
Breakpoint 1, next_nomacro1 () at tcc.c:3801
3801                while (isidnum_table[c]) {
(gdb) p c
$1 = -1
 
  Thank you,
  Cristian