#1152433 4ti2: FTBFS on ppc64el with GCC 15/16 (-O2/-O3): out-of-bounds array access in VectorAux (src/ppi/ppi.cpp)

Package:
src:4ti2
Source:
src:4ti2
Submitter:
Viktor Pashaiev
Date:
2026-10-29 08:53:02 UTC
Severity:
normal
Tags:
#1152433#5
Date:
2026-10-29 08:50:09 UTC
From:
To:
Dear Maintainer,

4ti2 fails its build-time test suite (test/ppi/check_ppi) on ppc64el when built with GCC 15/16 at -O2 or -O3 (including Ubuntu's default -O3 on ppc64el, tracked in https://bugs.launchpad.net/ubuntu/+source/4ti2/+bug/2170794).

In src/ppi/ppi.cpp, struct VectorAux declares a fixed-size array `signed char Stuff[4]`, stores the vector length in `Stuff[0]`, and returns `Stuff + 1` from `Data()`. Accessing `v(i)` for `i >= 4` indexes `Stuff[i]` past the 4-byte array bound.

In `ExtendPPI()`, the loop:

  for (int p = 1; p <= (n+1)/2; p++) {
    v(p)--, v(n+1-p)--;
    ...
  }

decrements both `v(p)` and `v(n+1-p)`. Because `p` starts within `Stuff[1..3]` while `n+1-p` exceeds `Stuff[3]` for `n >= 3`, GCC alias analysis on ppc64el concludes that the two accesses cannot alias and schedules the load `lbzu` of `v(n+1-p)` before the store `stb` of `v(p)`. When `n + 1` is even and `p == n + 1 - p` (first hit at `n = 3, p = 2`), `v(2)` is decremented from 0 to -1 instead of -2, producing the invalid identity `0 -1 0 1` and causing `4ti2-ppi 5` to output 50 vectors instead of 47.

The attached patch replaces `Stuff[4]` in `VectorAux` with an explicit `unsigned char len_` field and a `signed char data_[]` flexible array member. Verified on ppc64el at -O3 -flto=auto across ppi5 (47 vectors), ppi10 (2465 vectors), and ppi16 (99328 vectors).

Thanks,
Viktor Pashaiev