Is this a GCC bug or what?

Question

Ok, i've written this simple program in C:
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
int main(void)
char *c,*str,C[8];
unsigned short int D,y;
time_t h;
struct tm *t;
h=time(NULL);
t=gmtime(&h);
str=asctime(t);
sscanf(str,"%*s %*s %hu %s %hu",&D,C,&y);
c=malloc(31*sizeof(char));
snprintf(c,30,"%c%c%c, %hu-%c%c%c-%hu %s GMT",str[0],str[1],str[2],D,str[4],str[5],str[6],y,C);
printf("%s\n%s\n",str,c);
free(c);
return 0;
which uses only standard libc functions.
I've got a x86_64 Ubuntu 9.10 machine which uses gcc 4.4.1.
I compile that with -Wall -Wextra -pedantic -pedantic-errors.
ubuntu-desktop ~ $ uname -a
Linux ubuntu-desktop 2.6.31-16-generic #53-Ubuntu SMP Tue Dec 8 04:02:15 UTC 2009 x86_64 GNU/Linux
ubuntu-desktop ~ $ gcc -o tm tm.c -Wall -Wextra -pedantic -pedantic-errors
ubuntu-desktop ~ $ ./tm
Sun Jan 3 23:26:13 2010
Sun, 3-Jan-2010 23:26:13 GMT
The output is ok.
Now i compile it on an Archlinux x86 machine.
server C $ uname -a
Linux server 2.6.32-ARCH #1 SMP PREEMPT Sat Dec 26 08:26:17 UTC 2009 i686 Intel(R) Pentium(R) 4 CPU 1.60GHz GenuineIntel GNU/Linux
server C $ gcc -o tm tm.c -Wall -Wextra -pedantic -pedantic-errors
server C $ ./tm
Sun Jan 3 23:28:32 2010
Sun, 3-Jan-2010 23:28:32H
I can't explain how this could happen except with a kind of mistake in compiling GCC or in a GCC 4.4.2 bug.
After this, I've tried to compile the source with the Ubuntu GCC with -m32 and link it with the gcc of Archlinux.
This is the result:
server C $ ./tm
Sun Jan 3 23:35:51 2010
Sun, 3-Jan-2010 23:35:51 GMT
*** stack smashing detected ***: ./tm terminated
[bla,bla,bla...read this as the consequence of the different glibc version]
It works so, there's something wrong with gcc, but my knowledges can't find what.
Sorry for my English, but i'm Italian.
Last edited by krnlpk (2010-01-03 23:40:10)

Answer 1

No gcc bug; it's a bug in your program.  From what I can tell, the char array `C' is designed to hold a string like "01:15:48" which is 8 characters.  Hence, it needs to be declared as `char C[9]' to have room for the terminating \0.  `char C[8]' causes sscanf to smash your stack, as it writes the \0 byte somewhere else.  Making that change fixed the program on my computer.  Too bad valgrind can't detect that sort of error.