Bug in libpcap filter optimizator (optimize.c)

["Gianluca Varenni" <gianluca.varenni () cacetech com>]

Guys,

it looks like the optimizer for the BPF compiler has a bug and removes some 
needed LD instructions. This happens on the HEAD and 0.9.x branch (I tested 
it with optimize.c 1.87 and 1.85.2.1 as well as older versions).

Details
Linktype: DLT_802_11_RADIO (802.11 + radiotap) or DLT_802_11
Filter: "wlan src addr 1:2:3:4:5:6"

The following BPF dumps are generated with DLT_802_11, in the radiotap case 
the difference is that instead of being immediate loads from the packets 
(LD[0]), the index register X is used (LD[x+0]).

Un-optimized code

(000) ldb      [0]
(001) jset     #0x4             jt 31   jf 2
(002) ldb      [0]
(003) jset     #0x8             jt 8    jf 4
(004) ld       [12]
(005) jeq      #0x3040506       jt 6    jf 8
(006) ldh      [10]
(007) jeq      #0x102           jt 30   jf 8
(008) ldb      [1]
(009) jset     #0x8             jt 10   jf 31
(010) ldb      [1]
(011) jset     #0x2             jt 16   jf 12
(012) ld       [12]
(013) jeq      #0x3040506       jt 14   jf 16
(014) ldh      [10]
(015) jeq      #0x102           jt 30   jf 16
(016) ldb      [1]
(017) jset     #0x2             jt 18   jf 31
(018) ldb      [1]
(019) jset     #0x1             jt 24   jf 20
(020) ld       [18]
(021) jeq      #0x3040506       jt 22   jf 24
(022) ldh      [16]
(023) jeq      #0x102           jt 30   jf 24
(024) ldb      [1]
(025) jset     #0x1             jt 26   jf 31
(026) ld       [26]
(027) jeq      #0x3040506       jt 28   jf 31
(028) ldh      [24]
(029) jeq      #0x102           jt 30   jf 31
(030) ret      #96
(031) ret      #0

Optimized code
(000) ldb      [0]
(001) jset     #0x4             jt 23   jf 2
(002) jset     #0x8             jt 7    jf 3
(003) ld       [12]
(004) jeq      #0x3040506       jt 5    jf 7
(005) ldh      [10]
(006) jeq      #0x102           jt 22   jf 7
(007) jset     #0x8             jt 8    jf 23  <-- WRONG
(008) jset     #0x2             jt 9    jf 18  <-- WRONG
(009) jset     #0x1             jt 10   jf 14
(010) ld       [26]
(011) jeq      #0x3040506       jt 12   jf 23
(012) ldh      [24]
(013) jeq      #0x102           jt 22   jf 23
(014) ld       [18]
(015) jeq      #0x3040506       jt 16   jf 23
(016) ldh      [16]
(017) jeq      #0x102           jt 22   jf 23
(018) ld       [12]
(019) jeq      #0x3040506       jt 20   jf 23
(020) ldh      [10]
(021) jeq      #0x102           jt 22   jf 23
(022) ret      #96
(023) ret      #0

If instruction (007) is reached from instruction (006), the accumulator 
contains the value read in (005), that is packet[10] (2bytes). The optimizer 
is clearly removing a "ldb[1]" before the jset at (007).
In the un-optimized code the ldb[1] instruction is (008) and it's repeated 
at (010), (016), (018).

I have no idea where this optimization takes place :-(.

Anyone willing to help?

Have a nice day
GV


-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.