Out-of-bounds read in 6g (cmd/gc/lex.c:502)

[gopherbot]

by robert.swiecki:

What steps will reproduce the problem?
1. Run '6g SIGSEGV.PC.0x4434de.CODE.2.ADDR.0x7ffff7b2959e.INSTR.movzx_eax,_word_[rax].go'

What is the expected output?
*.6 file or error message

What do you see instead?
Crash (SIGSEGV(

What is your $GOOS?  $GOARCH?
linux/amd64

Which revision are you using?  (hg identify)
38ac4f394e2f+ tip

Please provide any additional information below.
$ gdb /usr/local/google/src/go/6g
(gdb) r SIGSEGV.PC.0x4434de.CODE.2.ADDR.0x7ffff7b2959e.INSTR.movzx_eax,_word_[rax].go

Program received signal SIGSEGV, Segmentation fault.
0x00000000004434de in _yylex () at /usr/local/google/src/go/src/cmd/gc/lex.c:502
502     if(isspace(c)) {

(gdb) bt
#0  0x00000000004434de in _yylex () at /usr/local/google/src/go/src/cmd/gc/lex.c:502
#1  0x00000000004447e3 in yylex () at /usr/local/google/src/go/src/cmd/gc/lex.c:1174
#2  0x000000000043cfd3 in yyparse () at y.tab.c:2179
#3  0x000000000044284b in p9main (argc=1, argv=0x7fffffffe630) at
/usr/local/google/src/go/src/cmd/gc/lex.c:175
#4  0x000000000044bab4 in main (argc=2, argv=0x7fffffffe628) at
/usr/local/google/src/go/src/lib9/main.c:35

(gdb) x/i $pc
=> 0x4434de <_yylex+61>:   movzx  eax,WORD PTR [rax]
(gdb) p $rax
0x7ffff7b2959e: Cannot access memory at address 0x7ffff7b2959e
(gdb) info proc 
process 12699
(gdb) shell cat /proc/12699/maps 
00400000-0046d000 r-xp 00000000 08:06 2730103                           
/usr/local/google/src/go/6g
0066c000-0066d000 r--p 0006c000 08:06 2730103                           
/usr/local/google/src/go/6g
0066d000-00674000 rw-p 0006d000 08:06 2730103                           
/usr/local/google/src/go/6g
00674000-0071d000 rw-p 00000000 00:00 0                                  [heap]
7ffff77d6000-7ffff7950000 r-xp 00000000 08:01 1352099                   
/lib/libc-2.11.1.so
7ffff7950000-7ffff7b4f000 ---p 0017a000 08:01 1352099                 
/lib/libc-2.11.1.so        <-- it's here, the page is mapped as PROT_NONE
7ffff7b4f000-7ffff7b53000 r--p 00179000 08:01 1352099                   
/lib/libc-2.11.1.so
7ffff7b53000-7ffff7b54000 rw-p 0017d000 08:01 1352099                   
/lib/libc-2.11.1.so
7ffff7b54000-7ffff7b59000 rw-p 00000000 00:00 0 
7ffff7b59000-7ffff7bdb000 r-xp 00000000 08:01 1352103                   
/lib/libm-2.11.1.so
7ffff7bdb000-7ffff7dda000 ---p 00082000 08:01 1352103                   
/lib/libm-2.11.1.so
7ffff7dda000-7ffff7ddb000 r--p 00081000 08:01 1352103                   
/lib/libm-2.11.1.so
7ffff7ddb000-7ffff7ddc000 rw-p 00082000 08:01 1352103                   
/lib/libm-2.11.1.so
7ffff7ddc000-7ffff7dfc000 r-xp 00000000 08:01 1352096                   
/lib/ld-2.11.1.so
7ffff7ee1000-7ffff7fda000 rw-p 00000000 00:00 0 
7ffff7ff9000-7ffff7ffb000 rw-p 00000000 00:00 0 
7ffff7ffb000-7ffff7ffc000 r-xp 00000000 00:00 0                          [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00020000 08:01 1352096                   
/lib/ld-2.11.1.so
7ffff7ffd000-7ffff7ffe000 rw-p 00021000 08:01 1352096                   
/lib/ld-2.11.1.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0 
7ffffffea000-7ffffffff000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

Attachments:

1. SIGSEGV.PC.0x4434de.CODE.2.ADDR.0x7ffff7b2959e.INSTR.movzx_eax,word[rax].go (4450 bytes)

[adg]

Comment 1:

Labels changed: added compilerbug, security.

Owner changed to [email protected].

Status changed to Accepted.

[rsc]

Comment 2:

This issue was closed by revision 0decedf.

Status changed to Fixed.