Message ID | 20220525104937.C71D413ADF@imap2.suse-dmz.suse.de |
---|---|
State | New |
Headers | show |
Series | tree-optimization/105726 - adjust array bound heuristic | expand |
On 5/25/22 04:49, Richard Biener wrote: > There's heuristic to detect ptr[1].a[...] out of bound accesses > reasoning that if ptr points to an array of aggregates a trailing > incomplete array has to have size zero. The following more > thoroughly constrains the cases this applies to avoid false > positive diagnostics. The code in the area below does look like it's missing some logic (like what you're adding). The whole -Wrestrict pass is messy and could use some cleanup (sorry). The -Warray-bounds logic should probably be removed (-Wstringop-overflow should now catch most of the valid instances it issues, and if it doesn't(*) it should be enhanced). The pass could even be moved into the access warning pass and probably also simplified quite a bit. For what it's worth, a simple C test case for the same bug is: struct A { int i; struct B { char a[1]; } b; }; void f (char *d, struct A *p) { struct B *q = &p->b; __builtin_strncpy (d, q->a, 1); // { dg-bogus "-Warray-bounds" } } Martin [*] For example, no warning is issued for the following overread: struct A a; void g (char *d) { struct B *q = &a.b; __builtin_strncpy (d, q->a, 123); // { dg-warning "-Wstringop-overread" "pr???????" { xfail *-*-* } } } > > Bootstrapped and tested on x86_64-unknown-linux-gnu. > > OK? > > Thanks, > Richard. > > 2022-05-25 Richard Biener <rguenther@suse.de> > > PR tree-optimization/105726 > * gimple-ssa-warn-restrict.cc (builtin_memref::set_base_and_offset): > Constrain array-of-flexarray case more. > > * g++.dg/warn/Warray-bounds-27.C: New testcase. > --- > gcc/gimple-ssa-warn-restrict.cc | 22 ++++++++++++-------- > gcc/testsuite/g++.dg/warn/Warray-bounds-27.C | 16 ++++++++++++++ > 2 files changed, 29 insertions(+), 9 deletions(-) > create mode 100644 gcc/testsuite/g++.dg/warn/Warray-bounds-27.C > > diff --git a/gcc/gimple-ssa-warn-restrict.cc b/gcc/gimple-ssa-warn-restrict.cc > index b678e806da3..734cdd7f5b4 100644 > --- a/gcc/gimple-ssa-warn-restrict.cc > +++ b/gcc/gimple-ssa-warn-restrict.cc > @@ -525,7 +525,6 @@ builtin_memref::set_base_and_offset (tree expr) > { > tree memrefoff = fold_convert (ptrdiff_type_node, TREE_OPERAND (base, 1)); > extend_offset_range (memrefoff); > - base = TREE_OPERAND (base, 0); > > if (refoff != HOST_WIDE_INT_MIN > && TREE_CODE (expr) == COMPONENT_REF) > @@ -538,14 +537,19 @@ builtin_memref::set_base_and_offset (tree expr) > REFOFF is set to s[1].b - (char*)s. */ > offset_int off = tree_to_shwi (memrefoff); > refoff += off; > - } > - > - if (!integer_zerop (memrefoff)) > - /* A non-zero offset into an array of struct with flexible array > - members implies that the array is empty because there is no > - way to initialize such a member when it belongs to an array. > - This must be some sort of a bug. */ > - refsize = 0; > + > + if (!integer_zerop (memrefoff) > + && !COMPLETE_TYPE_P (TREE_TYPE (expr)) > + && multiple_of_p (sizetype, memrefoff, > + TYPE_SIZE_UNIT (TREE_TYPE (base)), true)) > + /* A non-zero offset into an array of struct with flexible array > + members implies that the array is empty because there is no > + way to initialize such a member when it belongs to an array. > + This must be some sort of a bug. */ > + refsize = 0; > + } > + > + base = TREE_OPERAND (base, 0); > } > > if (TREE_CODE (ref) == COMPONENT_REF) > diff --git a/gcc/testsuite/g++.dg/warn/Warray-bounds-27.C b/gcc/testsuite/g++.dg/warn/Warray-bounds-27.C > new file mode 100644 > index 00000000000..06ce089c4b0 > --- /dev/null > +++ b/gcc/testsuite/g++.dg/warn/Warray-bounds-27.C > @@ -0,0 +1,16 @@ > +// PR105726 > +// { dg-do compile } > +// { dg-require-effective-target c++11 } > +// { dg-options "-O2 -Warray-bounds" } > + > +#include <array> > +#include <cstring> > + > +struct X { > + char pad[4]; > + std::array<char, 1> mField; > +}; > + > +void encode(char* aBuffer, const X& aMessage) { > + strncpy(aBuffer, aMessage.mField.data(), 1); // { dg-bogus "bounds" } > +}
On 5/25/22 11:19, Martin Sebor wrote: > On 5/25/22 04:49, Richard Biener wrote: ... > [*] For example, no warning is issued for the following overread: Scratch that, there is no overread with strncpy. When there is like with memcpy, it is diagnosed as it should be. > > struct A a; > > void g (char *d) > { > struct B *q = &a.b; > __builtin_strncpy (d, q->a, 123); // { dg-warning > "-Wstringop-overread" "pr???????" { xfail *-*-* } } > }
diff --git a/gcc/gimple-ssa-warn-restrict.cc b/gcc/gimple-ssa-warn-restrict.cc index b678e806da3..734cdd7f5b4 100644 --- a/gcc/gimple-ssa-warn-restrict.cc +++ b/gcc/gimple-ssa-warn-restrict.cc @@ -525,7 +525,6 @@ builtin_memref::set_base_and_offset (tree expr) { tree memrefoff = fold_convert (ptrdiff_type_node, TREE_OPERAND (base, 1)); extend_offset_range (memrefoff); - base = TREE_OPERAND (base, 0); if (refoff != HOST_WIDE_INT_MIN && TREE_CODE (expr) == COMPONENT_REF) @@ -538,14 +537,19 @@ builtin_memref::set_base_and_offset (tree expr) REFOFF is set to s[1].b - (char*)s. */ offset_int off = tree_to_shwi (memrefoff); refoff += off; - } - - if (!integer_zerop (memrefoff)) - /* A non-zero offset into an array of struct with flexible array - members implies that the array is empty because there is no - way to initialize such a member when it belongs to an array. - This must be some sort of a bug. */ - refsize = 0; + + if (!integer_zerop (memrefoff) + && !COMPLETE_TYPE_P (TREE_TYPE (expr)) + && multiple_of_p (sizetype, memrefoff, + TYPE_SIZE_UNIT (TREE_TYPE (base)), true)) + /* A non-zero offset into an array of struct with flexible array + members implies that the array is empty because there is no + way to initialize such a member when it belongs to an array. + This must be some sort of a bug. */ + refsize = 0; + } + + base = TREE_OPERAND (base, 0); } if (TREE_CODE (ref) == COMPONENT_REF) diff --git a/gcc/testsuite/g++.dg/warn/Warray-bounds-27.C b/gcc/testsuite/g++.dg/warn/Warray-bounds-27.C new file mode 100644 index 00000000000..06ce089c4b0 --- /dev/null +++ b/gcc/testsuite/g++.dg/warn/Warray-bounds-27.C @@ -0,0 +1,16 @@ +// PR105726 +// { dg-do compile } +// { dg-require-effective-target c++11 } +// { dg-options "-O2 -Warray-bounds" } + +#include <array> +#include <cstring> + +struct X { + char pad[4]; + std::array<char, 1> mField; +}; + +void encode(char* aBuffer, const X& aMessage) { + strncpy(aBuffer, aMessage.mField.data(), 1); // { dg-bogus "bounds" } +}