• Show log

    Commit

  • Hash : fe203ffb
    Author : mikulas-patocka
    Date : 2025-03-27T01:31:49

    Fix bugs in the x86-64 and x32 target (#887) (#889)
    
    This commit fixes two bugs in ffi in the x86-64 target. The bugs were
    introduced by the commit d21881f55ed4a44d464c9091871e69b0bb47611a ("Fix
    x86/ffi64 calls with 6 gp and some sse registers").
    
    The first bug is that when we pass an argument with less than 8 bytes,
    ffi will read memory beyond argument end, causing a crash if the argument
    is located just before the end of the mapped region.
    
    The second bug is in the x32 ABI - pointers in x32 are 4-byte, but GCC
    assumes that the pointer values in the registers are zero-extended. ffi
    doesn't respect this assumption, causing crashes in the called library.
    
    For example, when we compile this function for x32:
    int fn(int *a)
    {
    	if (a)
    		return *a;
    	return -1;
    }
    we get this code:
    fn:
    	testq   %rdi, %rdi
    	je      .L3
    	movl    (%edi), %eax
    	ret
    .L3:
    	movl    $-1, %eax
    	ret
    When we call this function using ffi with the argument NULL, the function
    crashes because top 4 bytes of the RDI register are not cleared.
    
    
    Fixes: d21881f55ed4 ("Fix x86/ffi64 calls with 6 gp and some sse registers (#848)")
    
    Signed-off-by: Mikulas Patocka <mikulas@twibright.com>