diff mbox series

[committed] analyzer: only use CWE-690 for unchecked return value [PR97893]

Message ID 20201118205809.4189479-1-dmalcolm@redhat.com
State New
Headers show
Series [committed] analyzer: only use CWE-690 for unchecked return value [PR97893] | expand

Commit Message

David Malcolm Nov. 18, 2020, 8:58 p.m. UTC
CWE-690 is only for dereferencing an unchecked return value; for
other kinds of NULL dereference, use the parent classification, CWE-476.

Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu.
Pushed to master as r11-5148-gf3f312b535f57b5773953746f6ad0d890ce09b88.

gcc/analyzer/ChangeLog:
	PR analyzer/97893
	* sm-malloc.cc (null_deref::emit): Use CWE-476 rather than
	CWE-690, as this isn't due to an unchecked return value.
	(null_arg::emit): Likewise.

gcc/testsuite/ChangeLog:
	PR analyzer/97893
	* gcc.dg/analyzer/malloc-1.c: Add CWE-690 and CWE-476 codes to
	expected output.
---
 gcc/analyzer/sm-malloc.cc                |  8 +++----
 gcc/testsuite/gcc.dg/analyzer/malloc-1.c | 30 ++++++++++++------------
 2 files changed, 19 insertions(+), 19 deletions(-)
diff mbox series

Patch

diff --git a/gcc/analyzer/sm-malloc.cc b/gcc/analyzer/sm-malloc.cc
index fd12a358176..4c387381137 100644
--- a/gcc/analyzer/sm-malloc.cc
+++ b/gcc/analyzer/sm-malloc.cc
@@ -675,9 +675,9 @@  public:
 
   bool emit (rich_location *rich_loc) FINAL OVERRIDE
   {
-    /* CWE-690: Unchecked Return Value to NULL Pointer Dereference.  */
+    /* CWE-476: NULL Pointer Dereference.  */
     diagnostic_metadata m;
-    m.add_cwe (690);
+    m.add_cwe (476);
     return warning_meta (rich_loc, m,
 			 OPT_Wanalyzer_null_dereference,
 			 "dereference of NULL %qE", m_arg);
@@ -723,10 +723,10 @@  public:
 
   bool emit (rich_location *rich_loc) FINAL OVERRIDE
   {
-    /* CWE-690: Unchecked Return Value to NULL Pointer Dereference.  */
+    /* CWE-476: NULL Pointer Dereference.  */
     auto_diagnostic_group d;
     diagnostic_metadata m;
-    m.add_cwe (690);
+    m.add_cwe (476);
 
     bool warned;
     if (zerop (m_arg))
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-1.c b/gcc/testsuite/gcc.dg/analyzer/malloc-1.c
index 44eca9fc28c..576ab9dee52 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-1.c
@@ -29,14 +29,14 @@  void test_2a (void *ptr)
 int *test_3 (void)
 {
   int *ptr = (int *)malloc (sizeof (int));
-  *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr'" } */
+  *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr' \\\[CWE-690\\\]" } */
   return ptr;
 }
 
 int *test_3a (void)
 {
   int *ptr = (int *)__builtin_malloc (sizeof (int));
-  *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr'" } */
+  *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr' \\\[CWE-690\\\]" } */
   return ptr;
 }
 
@@ -46,7 +46,7 @@  int *test_4 (void)
   if (ptr)
     *ptr = 42;
   else
-    *ptr = 43; /* { dg-warning "dereference of NULL 'ptr'" } */
+    *ptr = 43; /* { dg-warning "dereference of NULL 'ptr' \\\[CWE-476\\\]" } */
   return ptr;
 }
 
@@ -259,14 +259,14 @@  void test_22 (void)
 int *test_23 (int n)
 {
   int *ptr = (int *)calloc (n, sizeof (int));
-  ptr[0] = 42; /* { dg-warning "dereference of possibly-NULL 'ptr'" } */
+  ptr[0] = 42; /* { dg-warning "dereference of possibly-NULL 'ptr' \\\[CWE-690\\\]" } */
   return ptr;
 }
 
 int *test_23a (int n)
 {
   int *ptr = (int *)__builtin_calloc (n, sizeof (int));
-  ptr[0] = 42; /* { dg-warning "dereference of possibly-NULL 'ptr'" } */
+  ptr[0] = 42; /* { dg-warning "dereference of possibly-NULL 'ptr' \\\[CWE-690\\\]" } */
   return ptr;
 }
 
@@ -301,7 +301,7 @@  struct coord {
 struct coord *test_27 (void)
 {
   struct coord *p = (struct coord *) malloc (sizeof (struct coord)); /* { dg-message "this call could return NULL" } */
-  p->x = 0.f;  /* { dg-warning "dereference of possibly-NULL 'p'" } */
+  p->x = 0.f;  /* { dg-warning "dereference of possibly-NULL 'p' \\\[CWE-690\\\]" } */
 
   /* Only the first such usage should be reported: */
   p->y = 0.f;
@@ -312,7 +312,7 @@  struct coord *test_27 (void)
 struct coord *test_28 (void)
 {
   struct coord *p = NULL;
-  p->x = 0.f; /* { dg-warning "dereference of NULL 'p'" } */
+  p->x = 0.f; /* { dg-warning "dereference of NULL 'p' \\\[CWE-476\\\]" } */
 
   /* Only the first such usage should be reported: */
   p->y = 0.f;
@@ -415,7 +415,7 @@  void test_36 (void)
 void *test_37a (void)
 {
   void *ptr = malloc(4096); /* { dg-message "this call could return NULL" } */
-  __builtin_memset(ptr, 0, 4096); /* { dg-warning "use of possibly-NULL 'ptr' where non-null expected" } */
+  __builtin_memset(ptr, 0, 4096); /* { dg-warning "use of possibly-NULL 'ptr' where non-null expected \\\[CWE-690\\\]" } */
   return ptr;
 }
 
@@ -426,7 +426,7 @@  int test_37b (void)
   if (p) {
     __builtin_memset(p, 0, 4096); /* Not a bug: checked */
   } else {
-    __builtin_memset(q, 0, 4096); /* { dg-warning "use of possibly-NULL 'q' where non-null expected" } */
+    __builtin_memset(q, 0, 4096); /* { dg-warning "use of possibly-NULL 'q' where non-null expected \\\[CWE-690\\\]" } */
   }
   free(p);
   free(q);
@@ -451,7 +451,7 @@  int *
 test_39 (int i)
 {
   int *p = (int*)malloc(sizeof(int*)); /* { dg-message "this call could return NULL" } */
-  *p = i; /* { dg-warning "dereference of possibly-NULL 'p'" } */
+  *p = i; /* { dg-warning "dereference of possibly-NULL 'p' \\\[CWE-690\\\]" } */
   return p;
 }
 
@@ -459,7 +459,7 @@  int *
 test_40 (int i)
 {
   int *p = (int*)malloc(sizeof(int*));
-  i = *p; /* { dg-warning "dereference of possibly-NULL 'p'" } */
+  i = *p; /* { dg-warning "dereference of possibly-NULL 'p' \\\[CWE-690\\\]" } */
   /* TODO: (it's also uninitialized) */
   return p;
 }
@@ -475,8 +475,8 @@  test_41 (int flag)
     buffer = NULL;
   }
 
-  buffer[0] = 'a'; /* { dg-warning "dereference of possibly-NULL 'buffer'" "possibly-NULL" } */
-  /* { dg-warning "dereference of NULL 'buffer'" "NULL" { target *-*-* } .-1 } */
+  buffer[0] = 'a'; /* { dg-warning "dereference of possibly-NULL 'buffer' \\\[CWE-690\\\]" "possibly-NULL" } */
+  /* { dg-warning "dereference of NULL 'buffer' \\\[CWE-476\\\]" "NULL" { target *-*-* } .-1 } */
 
   return buffer;
 }
@@ -593,7 +593,7 @@  int test_47 (void)
 void test_48 (void)
 {
   int *p = NULL; /* { dg-message "'p' is NULL" } */
-  *p = 1; /* { dg-warning "dereference of NULL 'p'" } */
+  *p = 1; /* { dg-warning "dereference of NULL 'p' \\\[CWE-476\\\]" } */
 }
 
 /* As test_48, but where the assignment of NULL is not at the start of a BB.  */
@@ -605,6 +605,6 @@  int test_49 (int i)
 
   x = i * 2;
   p = NULL; /* { dg-message "'p' is NULL" } */
-  *p = 1; /* { dg-warning "dereference of NULL 'p'" } */
+  *p = 1; /* { dg-warning "dereference of NULL 'p' \\\[CWE-476\\\]" } */
   return x;
 }