public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug middle-end/101397] New: spurious warning writing to the result of stpcpy minus 1
@ 2021-07-09 18:23 msebor at gcc dot gnu.org
  2021-07-09 18:25 ` [Bug middle-end/101397] [11/12 Regression] " msebor at gcc dot gnu.org
                   ` (10 more replies)
  0 siblings, 11 replies; 12+ messages in thread
From: msebor at gcc dot gnu.org @ 2021-07-09 18:23 UTC (permalink / raw)
  To: gcc-bugs

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101397

            Bug ID: 101397
           Summary: spurious warning writing to the result of stpcpy minus
                    1
           Product: gcc
           Version: 11.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: msebor at gcc dot gnu.org
  Target Milestone: ---

This is reduced from a recent Glibc build with GCC 12 which shows the warning
below:

In function ‘nis_local_group’,
    inlined from ‘nis_local_group’ at nis_local_names.c:27:1:
nis_local_names.c:38:13: error: array subscript -1 is outside array bounds of
‘char[1025]’ [-Werror=array-bounds]
   38 |       if (cp[-1] != '.')
      |           ~~^~~~
nis_local_names.c: In function ‘nis_local_group’:
nis_local_names.c:29:15: note: at offset -1 into object ‘__nisgroup’ of size
1025
   29 |   static char __nisgroup[NIS_MAXNAMELEN + 1];
      |               ^~~~~~~~~~

The following test case shows the warning is a false positive.  Since stpcpy()
returns a pointer to the terminating null it appends to the destination neither
of the warnings below is appropriate since there's no indication that the
copied string is empty.  The output below is with GCC 11.1.  In GCC 12 the
second -Wstringop-overflow becomes a -Warray-bounds.

$ cat t.c && gcc -O2 -S -Wall t.c
void f (void*);

void g (const char *s)
{
  char d[8];
  char *t = __builtin_stpcpy (d, s);
  __builtin_strcpy (t - 1, "x");
  f (d);
}

void h (const char *s)
{
  char d[8];
  char *t = __builtin_stpcpy (d, s);
  t[-1] = 0;
  f (d);
}

t.c: In function ‘g’:
t.c:7:3: warning: ‘__builtin_memcpy’ writing 2 bytes into a region of size 0
overflows the destination [-Wstringop-overflow=]
    7 |   __builtin_strcpy (t - 1, "x");
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
t.c:5:8: note: at offset -1 into destination object ‘d’ of size 8
    5 |   char d[8];
      |        ^
t.c: In function ‘h’:
t.c:15:9: warning: writing 1 byte into a region of size 0
[-Wstringop-overflow=]
   15 |   t[-1] = 0;
      |   ~~~~~~^~~
t.c:13:8: note: at offset -1 into destination object ‘d’ of size 8
   13 |   char d[8];
      |        ^

^ permalink raw reply	[flat|nested] 12+ messages in thread
end of thread, other threads:[~2023-05-29 10:05 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-09 18:23 [Bug middle-end/101397] New: spurious warning writing to the result of stpcpy minus 1 msebor at gcc dot gnu.org
2021-07-09 18:25 ` [Bug middle-end/101397] [11/12 Regression] " msebor at gcc dot gnu.org
2021-07-12 17:20 ` msebor at gcc dot gnu.org
2021-07-15  1:50 ` msebor at gcc dot gnu.org
2021-07-20 19:52 ` cvs-commit at gcc dot gnu.org
2021-07-20 19:53 ` [Bug middle-end/101397] [11 " msebor at gcc dot gnu.org
2021-07-28  7:07 ` rguenth at gcc dot gnu.org
2021-10-26 14:24 ` siddhesh at gotplt dot org
2021-11-09  0:06 ` msebor at gcc dot gnu.org
2021-12-09 16:58 ` msebor at gcc dot gnu.org
2022-04-21  7:49 ` rguenth at gcc dot gnu.org
2023-05-29 10:05 ` jakub at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).