From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 570573858C50; Thu, 7 Apr 2022 12:47:18 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 570573858C50 From: "dmalcolm at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug analyzer/102308] False positive -Wanalyzer-malloc-leak when writing to array in struct Date: Thu, 07 Apr 2022 12:47:18 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: analyzer X-Bugzilla-Version: 11.1.0 X-Bugzilla-Keywords: diagnostic X-Bugzilla-Severity: normal X-Bugzilla-Who: dmalcolm at gcc dot gnu.org X-Bugzilla-Status: ASSIGNED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: dmalcolm at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: gcc-bugs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-bugs mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Apr 2022 12:47:18 -0000 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D102308 --- Comment #2 from David Malcolm --- I typoed this bug's ID 102308 as 102208 in the commit message; so the messa= ge went to the wrong bug; here's a copy-and-paste of the commit notification t= hat went there: The master branch has been updated by David Malcolm : https://gcc.gnu.org/g:88b939b19ab454ab2d932ef292bbc557abe4431c commit r12-8047-g88b939b19ab454ab2d932ef292bbc557abe4431c Author: David Malcolm Date: Thu Apr 7 08:33:26 2022 -0400 analyzer: fix leak false +ve with symbolic writes [PR102208] PR analyzer/102208 reports false positives from -Wanalyzer-malloc-leak. The root cause is the analyzer getting confused about symbolic writes that could alias a pointer referencing a malloced buffer. struct st { void *ptr; int arr[10]; }; struct st test (int idx) { struct st s; s.ptr =3D __builtin_malloc (1024); /* (1) */ s.arr[idx] =3D 42; /* (2) */ return s; } When removing overlapping bindings at (2), store::remove_overlapping_bindings was failing to pass on the uncertainty_t *, and thus when clobbering the binding of s.ptr, the heap-allocated pointer was not being added to the set of maybe-bound svalues, and thus being treated as leaking. This patch fixes this, so that s.ptr from (1) is treated as maybe-bound after the write at (2), fixing the leak false postive. Doing so requires the store to be smarter about how clobbering happens with various combinations of concrete keys and symbolic keys within concrete clusters and symbolic clusters, so that we don't lose warnings about definite leaks. gcc/analyzer/ChangeLog: PR analyzer/102208 * store.cc (binding_map::remove_overlapping_bindings): Add "always_overlap" param, using it to generalize to the case where we want to remove all bindings. Update "uncertainty" logic to only record maybe-bound values for cases where there is a symbo= lic write involved. (binding_cluster::mark_region_as_unknown): Split param "reg" in= to "reg_to_bind" and "reg_for_overlap". (binding_cluster::maybe_get_compound_binding): Pass "false" to binding_map::remove_overlapping_bindings new "always_overlap" param. (binding_cluster::remove_overlapping_bindings): Determine "always_overlap" and pass it to binding_map::remove_overlapping_bindings. (store::set_value): Pass uncertainty to remove_overlapping_bind= ings call. Update for new param of binding_cluster::mark_region_as_unknown, passing both the base region of the iter_cluster, and the lhs_reg. (store::mark_region_as_unknown): Update for new param of binding_cluster::mark_region_as_unknown, passing "reg" for both. (store::remove_overlapping_bindings): Add param "uncertainty", = and pass it on to call to binding_cluster::remove_overlapping_bindings. * store.h (binding_map::remove_overlapping_bindings): Add "always_overlap" param. (binding_cluster::mark_region_as_unknown): Split param "reg" in= to "reg_to_bind" and "reg_for_overlap". (store::remove_overlapping_bindings): Add param "uncertainty". gcc/testsuite/ChangeLog: PR analyzer/102208 * gcc.dg/analyzer/symbolic-9.c: New test. * gcc.dg/analyzer/torture/leak-pr102308-1.c: New test. * gcc.dg/analyzer/torture/leak-pr102308-2.c: New test. Signed-off-by: David Malcolm =