[LLVMbugs] [Bug 16103] New: heap-buffer-oveflow in llvm::AMDGPUIntrinsicInfo::lookupName

Wed May 22 00:09:44 PDT 2013

http://llvm.org/bugs/show_bug.cgi?id=16103

            Bug ID: 16103
           Summary: heap-buffer-oveflow in
                    llvm::AMDGPUIntrinsicInfo::lookupName
           Product: new-bugs
           Version: trunk
          Hardware: PC
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: new bugs
          Assignee: unassignedbugs at nondot.org
          Reporter: samsonov at google.com
                CC: eugeni.stepanov at gmail.com, kcc at google.com,
                    llvmbugs at cs.uiuc.edu, tstellar at gmail.com, vljn at ovi.com
    Classification: Unclassified

[ Note: I found no Backend:R600 component ]

ASan reports heap-buffer-overflow in the following tests:
    LLVM :: CodeGen/R600/fabs.ll
    LLVM :: CodeGen/R600/literals.ll
    LLVM :: CodeGen/R600/llvm.AMDGPU.tex.ll
    LLVM :: CodeGen/R600/schedule-if-2.ll

==7601==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000b305
at pc 0xe31c89 bp 0x7fffab01f810 sp 0x7fffab01f808
READ of size 1 at 0x60300000b305 thread T0
    #0 0xe31c88 in llvm::AMDGPUIntrinsicInfo::lookupName(char const*, unsigned
int) const llvm_build_asan/lib/Target/R600/AMDGPUGenIntrinsics.inc:363
    #1 0x16db6bb in llvm::SelectionDAGBuilder::visitCall(llvm::CallInst const&)
llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp:5544
    #2 0x16c9a48 in llvm::SelectionDAGBuilder::visit(unsigned int, llvm::User
const&) llvm/include/llvm/IR/Instruction.def:164
    #3 0x16c7fe0 in llvm::SelectionDAGBuilder::visit(llvm::Instruction const&)
llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp:956
    #4 0x1781b63 in
llvm::SelectionDAGISel::SelectBasicBlock(llvm::ilist_iterator<llvm::Instruction
const>, llvm::ilist_iterator<llvm::Instruction const>, bool&)
llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:517
    #5 0x177ccf7 in llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function
const&) llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:1126
    #6 0x1779687 in
llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&)
llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:386
    #7 0x1c21d3c in llvm::MachineFunctionPass::runOnFunction(llvm::Function&)
llvm/lib/CodeGen/MachineFunctionPass.cpp:33
    #8 0x250d6e6 in llvm::FPPassManager::runOnFunction(llvm::Function&)
llvm/lib/IR/PassManager.cpp:1530
    #9 0x250dc65 in llvm::FPPassManager::runOnModule(llvm::Module&)
llvm/lib/IR/PassManager.cpp:1550
    #10 0x250e473 in llvm::MPPassManager::runOnModule(llvm::Module&)
llvm/lib/IR/PassManager.cpp:1608
    #11 0x250f5f3 in llvm::PassManagerImpl::run(llvm::Module&)
llvm/lib/IR/PassManager.cpp:1703
    #12 0x250fa4f in llvm::PassManager::run(llvm::Module&)
llvm/lib/IR/PassManager.cpp:1738
    #13 0x51630f in compileModule llvm/tools/llc/llc.cpp:377
    #14 0x51630f in main llvm/tools/llc/llc.cpp:195
    #15 0x7f6cd112876c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
    #16 0x512d14 (llvm_build_asan/bin/llc+0x512d14)
0x60300000b305 is located 0 bytes to the right of 21-byte region
[0x60300000b2f0,0x60300000b305)
allocated by thread T0 here:
    #0 0x4ffa25 in __interceptor_malloc
llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
    #1 0x253d082 in Allocate llvm/include/llvm/Support/Allocator.h:36
    #2 0x253d082 in Create<llvm::MallocAllocator, llvm::Value *>
llvm/include/llvm/ADT/StringMap.h:153
    #3 0x253d082 in Create<llvm::Value *> llvm/include/llvm/ADT/StringMap.h:179
    #4 0x253d082 in Create llvm/include/llvm/ADT/StringMap.h:183
    #5 0x253d082 in llvm::Value::setName(llvm::Twine const&)
llvm/lib/IR/Value.cpp:215
    #6 0x243a57c in getUnqual llvm/include/llvm/IR/GlobalValue.h:64
    #7 0x243a57c in llvm::Function::Function(llvm::FunctionType*,
llvm::GlobalValue::LinkageTypes, llvm::Twine const&, llvm::Module*)
llvm/lib/IR/Function.cpp:188
    #8 0x1379020 in Twine llvm/include/llvm/IR/Function.h:130
    #9 0x1379020 in llvm::LLParser::GetGlobalVal(std::string const&,
llvm::Type*, llvm::SMLoc) llvm/lib/AsmParser/LLParser.cpp:998
    #10 0x138a68f in llvm::LLParser::ConvertValIDToValue(llvm::Type*,
llvm::ValID&, llvm::Value*&, llvm::LLParser::PerFunctionState*)
llvm/lib/AsmParser/LLParser.cpp:2797
    #11 0x139bb93 in llvm::LLParser::ParseCall(llvm::Instruction*&,
llvm::LLParser::PerFunctionState&, bool) llvm/lib/AsmParser/LLParser.cpp:3967
    #12 0x138da37 in llvm::LLParser::ParseInstruction(llvm::Instruction*&,
llvm::BasicBlock*, llvm::LLParser::PerFunctionState&)
llvm/lib/AsmParser/LLParser.cpp:3305
    #13 0x138d1b1 in
llvm::LLParser::ParseBasicBlock(llvm::LLParser::PerFunctionState&)
llvm/lib/AsmParser/LLParser.cpp:3183
    #14 0x136801f in llvm::LLParser::ParseFunctionBody(llvm::Function&)
llvm/lib/AsmParser/LLParser.cpp:3136
    #15 0x13564a5 in ParseDefine llvm/lib/AsmParser/LLParser.cpp:424
    #16 0x13564a5 in llvm::LLParser::ParseTopLevelEntities()
llvm/lib/AsmParser/LLParser.cpp:226
    #17 0x135613d in llvm::LLParser::Run() llvm/lib/AsmParser/LLParser.cpp:41
    #18 0x1348885 in llvm::ParseAssembly(llvm::MemoryBuffer*, llvm::Module*,
llvm::SMDiagnostic&, llvm::LLVMContext&) llvm/lib/AsmParser/Parser.cpp:38
    #19 0x11fe2f8 in llvm::ParseIR(llvm::MemoryBuffer*, llvm::SMDiagnostic&,
llvm::LLVMContext&) llvm/lib/IRReader/IRReader.cpp:76
    #20 0x11febdb in llvm::ParseIRFile(std::string const&, llvm::SMDiagnostic&,
llvm::LLVMContext&) llvm/lib/IRReader/IRReader.cpp:88
    #21 0x516f8b in compileModule llvm/tools/llc/llc.cpp:212
    #22 0x516f8b in main llvm/tools/llc/llc.cpp:195
    #23 0x7f6cd112876c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
SUMMARY: AddressSanitizer: heap-buffer-overflow
llvm_build_asan/lib/Target/R600/AMDGPUGenIntrinsics.inc:363
llvm::AMDGPUIntrinsicInfo::lookupName(char const*, unsigned int) const

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20130522/dece6013/attachment.html>