Re: SSE related security hole

Jan Hubicka
2002-04-17T15:23:38Z

[-- Attachment #1: Type: text/plain, Size: 302 bytes --]

Hi,
Jakub asked me to cleanup the source and post assembly file. Here it comes.

#include <stdlib.h>
#include <stdio.h>

int
m ()
{
int i, n = 7;
float comp, sum = 0;
sin(1);
for (i = 1; i <= n; ++i)
sum += i;
printf ("sum of %d ints: %g\n", n, sum);
return 0;
}

main ()
{
m ();
}

[-- Attachment #2: bad3.s --]
[-- Type: text/plain, Size: 810 bytes --]

.file "bad3.c"
.section .rodata
.LC1:
.string "sum of %d ints: %g\n"
.text
.align 2
.p2align 4,,15
.globl m
.type m,@function
m:
pushl %ebp
movl %esp, %ebp
pxor %xmm1, %xmm1
subl $24, %esp
movss %xmm1, -4(%ebp)
movl $0, (%esp)
movl $1072693248, 4(%esp)
call sin
fstp %st(0)
movl $1, %eax
.p2align 4,,15
.L6:
cvtsi2ss %eax, %xmm1
incl %eax
cmpl $7, %eax
addss -4(%ebp), %xmm1
movss %xmm1, -4(%ebp)
jle .L6
flds -4(%ebp)
movl $.LC1, (%esp)
movl $7, 4(%esp)
fstpl 8(%esp)
call printf
leave
xorl %eax, %eax
ret
.Lfe1:
.size m,.Lfe1-m
.align 2
.p2align 4,,15
.globl main
.type main,@function
main:
pushl %ebp
movl %esp, %ebp
subl $8, %esp
andl $-16, %esp
call m
movl %ebp, %esp
popl %ebp
ret
.Lfe2:
.size main,.Lfe2-main
.ident "GCC: (GNU) 3.2 20020415 (experimental)"