Menu

#3821 Register A overwritten during pointer read on sm83

closed-fixed
None
GBZ80
5
2025-01-29
2025-01-20
No

This bug can result in wrong code being generated silently. It was originally found by a gbdk developer; for their codebase, this bug being triggered is a regression from SDCC 4.4.0:

https://github.com/gbdk-2020/gbdk-2020/issues/739

In src/z80/gen.c, line 14437, we have

      else
        fetchPair (pair, left->aop);
    }

Here, no information on which registers are available is passed (unlike fetchPairLong, which has a crude mechanism to do so, or genMove, which can pass more detailed information). For sm83, the code generated by this fetchPair call might use register a, which results in it being overwritten if it is already in use for some other purpose.

P.S.: I do not yet have C source to reproduce the issue for creating a regression test.

Discussion

  • Philipp Klaus Krause

    • Description has changed:

    Diff:

    --- old
    +++ new
    @@ -11,3 +11,5 @@
     ~~~~
    
     Here, no information on which registers are available is passed (unlike fetchPairLong, which has a crude mechanism to do so, or genMove, which can pass more detailed information). For sm83, the code generated by this fetchPair call might use register a, which results in it being overwritten if it is already in use for some other purpose.
    +
    +P.S.: I do not yet have C source to reproduce the issue for creating a regression test.
    
     
  • Philipp Klaus Krause

    The attached patch should fix this; I see no regression tests failing with it applied (though there is a tiny code size increase for sm83).

     
  • Philipp Klaus Krause

    • status: open --> closed-fixed
    • assigned_to: Philipp Klaus Krause
     
  • Philipp Klaus Krause

    This has been fixed for SDCC 4.5.0.

     

Log in to post a comment.

Monday.com Logo