@@ -971,7 +971,7 @@ region_model::impl_call_va_arg (const call_details &cd)
const frame_region *frame_reg = arg_reg->get_frame_region ();
unsigned next_arg_idx = arg_reg->get_index ();
- if (get_stack_depth () > 1)
+ if (frame_reg->get_stack_depth () > 1)
{
/* The interprocedural case: the called frame will have been
populated with any variadic aruguments.
@@ -1009,7 +1009,7 @@ region_model::impl_call_va_arg (const call_details &cd)
any specific var_arg_regions populated within it.
We already have a conjured_svalue for the result, so leave
it untouched. */
- gcc_assert (get_stack_depth () == 1);
+ gcc_assert (frame_reg->get_stack_depth () == 1);
}
if (saw_problem)
new file mode 100644
@@ -0,0 +1,57 @@
+typedef __builtin_va_list va_list;
+
+struct printf_spec {
+ unsigned int type;
+};
+
+int
+format_decode(const char *fmt, struct printf_spec *spec);
+
+static int vbin_printf(const char *fmt, va_list args) {
+ struct printf_spec spec;
+ int width = 0;
+
+ while (*fmt) {
+ int read = format_decode(fmt, &spec);
+
+ fmt += read;
+
+ switch (spec.type) {
+ case 0:
+ break;
+ case 1:
+ width = __builtin_va_arg(args, int); /* { dg-bogus "-Wanalyzer-va-list-exhausted" } */
+ break;
+ }
+ }
+
+ return width;
+}
+
+int bprintf(const char *fmt, ...) {
+ va_list args;
+ int ret;
+
+ __builtin_va_start(args, fmt);
+ ret = vbin_printf(fmt, args);
+ __builtin_va_end(args);
+
+ return ret;
+}
+
+static int called_by_test_2 (va_list args)
+{
+ return __builtin_va_arg(args, int); /* { dg-bogus "-Wanalyzer-va-list-exhausted" } */
+}
+
+int test_2 (const char *fmt, ...)
+{
+ va_list args;
+ int ret;
+
+ __builtin_va_start (args, fmt);
+ ret = called_by_test_2 (args);
+ __builtin_va_end (args);
+
+ return ret;
+}
Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu. Pushed to trunk as r13-1786-gb852aa7f265424. gcc/analyzer/ChangeLog: PR analyzer/106383 * varargs.cc (region_model::impl_call_va_arg): When determining if we're doing interprocedural analysis, use the stack depth of the frame in which va_start was called, rather than the current stack depth. gcc/testsuite/ChangeLog: PR analyzer/106383 * gcc.dg/analyzer/stdarg-3.c: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com> --- gcc/analyzer/varargs.cc | 4 +- gcc/testsuite/gcc.dg/analyzer/stdarg-3.c | 57 ++++++++++++++++++++++++ 2 files changed, 59 insertions(+), 2 deletions(-) create mode 100644 gcc/testsuite/gcc.dg/analyzer/stdarg-3.c