[Bug gas/11136] New: segmentaion fault while processing NEON arithmetric instructions

[andre dot bergner dot 0 at googlemail dot com]

The following one-line-program can reproduce the bug:

main()  { asm("  vmul.f32   q0,q1,q2  "); }

Compiling and assembling this code will result in a 'Segmentation fault" caused 
by gas. However the seg.fault seems to appear only when assembling directly on 
an ARM device (in my case Nokia N900) or within the scratchbox developing 
environment as well, here not using the cross-assembler, but an native ARM 
version. I compiles gas with configure -target=arm-linux-gnueabi

Using gdb I found the error producing code in file gas/config/tc-arm.c in 
function neon_check_type(), line 12055 (version from beginning Jan 2010):
    unsigned regwidth = neon_shape_el_size[regshape], match;
Here regshape has a random value causing unpredictable memory access via 
neon_shape_el_size[]. One line before regshape is assigned a value from 
neon_shape_tab[ns] with ns=40=NS_NULL, but neon_shape_tab[] has 40 entries only
[0..39], thus accessing the 41st entry will return the random value (64 in my 
case) for regshape.

The invalid value ns=NS_NULL=40 is passed to neon_check_type() by function 
try_vfp_nsyn() which got this wrong value in before from a call to 
neon_select_shape(). This function should catch a value of NS_NULL as error 
"invalid instruction shape" but somehow does not. Besides from the uncaught 
error the code is valid.

-- 
           Summary: segmentaion fault while processing NEON arithmetric
                    instructions
           Product: binutils
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: gas
        AssignedTo: unassigned at sources dot redhat dot com
        ReportedBy: andre dot bergner dot 0 at googlemail dot com
                CC: bug-binutils at gnu dot org
 GCC build triplet: arm-linux-gnueabi
  GCC host triplet: arm-linux-gnueabi
GCC target triplet: arm-linux-gnueabi


http://sourceware.org/bugzilla/show_bug.cgi?id=11136

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.