Vulnerability Development: Re: get SP on Solaris (SPARC) with GCC 3.3.2

[Jonathon Giffin <giffin () cs wisc edu>]

> unsigned long get_sp(void)
> {
>          __asm__("mov %sp,%i0");
> }
>
> doesn't work if compiled with the gcc 3.3.2, the address returned by the
> function will be the current PC.
> If compiler with gcc 3.2 work fine.
Inode--

My reply is based on my experimentation on my machine; results elsewhere
may differ.

I don't know why, but 3.3.2 (with no optimization) inserts an extra
assembly instruction into get_sp:
        save    %sp, -112, %sp
        mov %sp,%i0
        mov     %g1, %i0
        ret
        restore

The return value gets overwritten with whatever is in %g1. This need not
be the current pc. The 3.2 compiler does not insert the extra mov
instruction, so you get the behavior that you expected.

For code that works with both compilers and no optimization, use:

unsigned long get_sp (void)
{
  __asm__("mov %sp,%g1");
  __asm__("mov %g1,%i0");
}

If you compile with -O (optimization), then 3.3.2 will not insert the
extra mov instruction and you can use

unsigned long get_sp (void)
{
  __asm__("mov %sp,%o0");
}

with both compilers. Note that the mov destination must be OUTPUT register
0 because optimization will produce a leaf function.

Thanks,

Jon