public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* gcc -fanalyzer: false positives: use after free, double free
@ 2021-02-01 1:23 Heinrich Schuchardt
0 siblings, 0 replies; only message in thread
From: Heinrich Schuchardt @ 2021-02-01 1:23 UTC (permalink / raw)
To: David Malcolm
gcc (Debian 11-20210130-1) 11.0.0 20210130 (experimental) [master
revision 4d31df40899:799f8820257:2900f2f2c5fb234678eb8b76564e5994ec5970b9]
gcc -fanalyzer for the sample code below gives false positive results.
If I remove field ref from struct marker, no problem is reported.
Best regards
Heinrich
test.c
======
#include <stdlib.h>
struct marker {
struct marker *next;
void *ref;
};
struct data {
struct marker *marker;
};
void data_free(struct data d)
{
struct marker *nm, *m;
m = d.marker;
while (m) {
nm = m->next;
free(m->ref);
free(m);
m = nm;
}
}
$ gcc test.c -fanalyzer -c
test.c: In function ‘data_free’:
test.c:17:20: warning: use after ‘free’ of ‘m’ [CWE-416]
[-Wanalyzer-use-after-free]
17 | nm = m->next;
| ~~~^~~~~~~~~
‘data_free’: events 1-18
|
| 16 | while (m) {
| | ^
| | |
| | (1) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (3) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (5) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (7) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (10) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (12) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (14) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (16) following ‘true’ branch (when ‘m’ is
non-NULL)...
| 17 | nm = m->next;
| | ~~~~~~~~~~~~
| | |
| | (2) ...to here
| | (4) ...to here
| | (6) ...to here
| | (8) ...to here
| | (11) ...to here
| | (13) ...to here
| | (15) ...to here
| | (17) ...to here
| | (18) use after ‘free’ of ‘m’; freed at (9)
| 18 | free(m->ref);
| 19 | free(m);
| | ~~~~~~~
| | |
| | (9) freed here
|
test.c:18:17: warning: double-‘free’ of ‘*m.ref’ [CWE-415]
[-Wanalyzer-double-free]
18 | free(m->ref);
| ^~~~~~~~~~~~
‘data_free’: events 1-16
|
| 16 | while (m) {
| | ^
| | |
| | (1) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (3) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (5) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (8) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (10) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (12) following ‘true’ branch (when ‘m’ is
non-NULL)...
| | (14) following ‘true’ branch (when ‘m’ is
non-NULL)...
| 17 | nm = m->next;
| | ~~~~~~~~~~~~
| | |
| | (2) ...to here
| | (4) ...to here
| | (6) ...to here
| | (9) ...to here
| | (11) ...to here
| | (13) ...to here
| | (15) ...to here
| 18 | free(m->ref);
| | ~~~~~~~~~~~~
| | |
| | (7) first ‘free’ here
| | (16) second ‘free’ here; first ‘free’ was
at (7)
|
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2021-02-01 1:23 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-01 1:23 gcc -fanalyzer: false positives: use after free, double free Heinrich Schuchardt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).