diff mbox series

[06/21] analyzer: fix ICE on division of tainted floating-point values [PR110700]

Message ID 20240509174236.2278921-7-dmalcolm@redhat.com
State New
Headers show
Series Various backports to gcc 13 (analyzer, jit, diagnostics) | expand

Commit Message

David Malcolm May 9, 2024, 5:42 p.m. UTC 
gcc/analyzer/ChangeLog:
	PR analyzer/110700
	* region-model-manager.cc
	(region_model_manager::get_or_create_int_cst): Assert that we have
	an integral or pointer type.
	* sm-taint.cc (taint_state_machine::check_for_tainted_divisor):
	Don't check non-integral types.

gcc/testsuite/ChangeLog:
	PR analyzer/110700
	* gcc.dg/analyzer/taint-divisor-2.c: New test.

(cherry picked from commit r14-2658-gb86c0fe327a519)

Signed-off-by: David Malcolm <dmalcolm@redhat.com>
---
 gcc/analyzer/region-model-manager.cc            |  3 ++-
 gcc/analyzer/sm-taint.cc                        |  6 ++++++
 gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c | 13 +++++++++++++
 3 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c
diff mbox series

Patch

diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc
index fab5bba15d5..1a9886fd83c 100644
--- a/gcc/analyzer/region-model-manager.cc
+++ b/gcc/analyzer/region-model-manager.cc
@@ -233,7 +233,8 @@  const svalue *
 region_model_manager::get_or_create_int_cst (tree type, poly_int64 val)
 {
   gcc_assert (type);
-  tree tree_cst = build_int_cst (type, val);
+  gcc_assert (INTEGRAL_TYPE_P (type) || POINTER_TYPE_P (type));
+  tree tree_cst = wide_int_to_tree (type, val);
   return get_or_create_constant_svalue (tree_cst);
 }
 
diff --git a/gcc/analyzer/sm-taint.cc b/gcc/analyzer/sm-taint.cc
index f72f194460c..7bce3ef79b2 100644
--- a/gcc/analyzer/sm-taint.cc
+++ b/gcc/analyzer/sm-taint.cc
@@ -1344,6 +1344,12 @@  taint_state_machine::check_for_tainted_divisor (sm_context *sm_ctxt,
     return;
 
   tree divisor_expr = gimple_assign_rhs2 (assign);;
+
+  /* Until we track conditions on floating point values, we can't check to
+     see if they've been checked against zero.  */
+  if (!INTEGRAL_TYPE_P (TREE_TYPE (divisor_expr)))
+    return;
+
   const svalue *divisor_sval = old_model->get_rvalue (divisor_expr, NULL);
 
   state_t state = sm_ctxt->get_state (assign, divisor_sval);
diff --git a/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c b/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c
new file mode 100644
index 00000000000..de9a1cb3a46
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c
@@ -0,0 +1,13 @@ 
+// TODO: remove need for this option:
+/* { dg-additional-options "-fanalyzer-checker=taint" } */
+
+#include "analyzer-decls.h"
+
+__attribute__ ((tainted_args))
+double pr110700 (double x, double y)
+{
+  /* Ideally we'd complain here with -Wanalyzer-tainted-divisor, but
+     until we track conditions on floating point values, we can't check to
+     see if they've been checked against zero.  */
+  return x / y;
+}