From 815cfe3fac24ebf7cea186ca161cf9d1b09c4b41 Mon Sep 17 00:00:00 2001 From: Robert Pengelly Date: Sat, 22 Aug 2026 17:37:50 +0100 Subject: [PATCH] Fixed floating-point dereference in va_arg expressions --- amd64.c | 9 +++++++++ i386.c | 9 +++++++++ 2 files changed, 18 insertions(+) diff --git a/amd64.c b/amd64.c index 2c6572f..881406c 100644 --- a/amd64.c +++ b/amd64.c @@ -22756,6 +22756,15 @@ static void emit_load_floating_rhs_operand_now (int result_size) { if (is_type_start (tok.kind) && parse_deref_cast_type_name (&deref_size)) { + /* + * parse_deref_cast_type_name() consumes only the cast in + * *(type *)expr. The following expression still has to be + * evaluated to obtain the address before loading through it. + * This is especially important for va_arg(), whose expansion + * uses a parenthesized comma expression here. + */ + emit_load_assignment_rhs_to_reg ("rax"); + emit_load_any_deref_as_floating_now ("rax", deref_size, last_deref_cast_type_is_floating); return; diff --git a/i386.c b/i386.c index 76086a6..4d28806 100644 --- a/i386.c +++ b/i386.c @@ -21491,6 +21491,15 @@ static void emit_load_floating_rhs_operand_now (int result_size) { if (is_type_start (tok.kind) && parse_deref_cast_type_name (&deref_size)) { + /* + * parse_deref_cast_type_name() consumes only the cast in + * *(type *)expr. The following expression still has to be + * evaluated to obtain the address before loading through it. + * This is especially important for va_arg(), whose expansion + * uses a parenthesized comma expression here. + */ + emit_load_assignment_rhs_to_reg ("eax"); + emit_load_any_deref_as_floating_now ("eax", deref_size, last_deref_cast_type_is_floating); return; -- 2.34.1