[Bug c++/102466] New: -O3 -fsanitize=undefined causes warnings (writing 2 bytes into a region of size 0)

[Bug c++/102466] New: -O3 -fsanitize=undefined causes warnings (writing 2 bytes into a region of size 0)

[unlvsur at live dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102466

            Bug ID: 102466
           Summary: -O3 -fsanitize=undefined causes warnings  (writing 2
                    bytes into a region of size 0)
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: unlvsur at live dot com
  Target Milestone: ---

Created attachment 51503
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51503&action=edit
Preprocessed file

without -fsanitize=undefined or use -O2 won't trigger the warning here

cqwrteur@Home-Server:~/fast_io/examples/0021.kernel_driver$ g++ -S main.cc
-std=c++20 -I../../include  -s -fno-exceptions -fno-rtti -fsanitize=undefined
-O3 -ffreestanding
In function 'constexpr void
fast_io::linux::print_status_define(fast_io::linux::basic_kpr<ch_type>, Args
...) [with bool line = true; ch_type = char; Args =
{fast_io::basic_io_scatter_t<char>,
fast_io::manipulators::scalar_manip_t<fast_io::manipulators::scalar_flags{10,
false, false, false, false, false, false, false, true, false, false, false,
fast_io::manipulators::scalar_placement::none,
fast_io::manipulators::floating_format::fixed,
fast_io::manipulators::lc_time_flag::none}, int>,
fast_io::basic_io_scatter_t<char>, fast_io::basic_io_scatter_t<char>,
fast_io::manipulators::scalar_manip_t<fast_io::manipulators::scalar_flags{10,
false, false, false, false, false, false, false, true, false, false, false,
fast_io::manipulators::scalar_placement::none,
fast_io::manipulators::floating_format::fixed,
fast_io::manipulators::lc_time_flag::none}, int>,
fast_io::manipulators::scalar_manip_t<fast_io::manipulators::scalar_flags{10,
false, false, false, false, false, false, false, true, false, false, false,
fast_io::manipulators::scalar_placement::none,
fast_io::manipulators::floating_format::fixed,
fast_io::manipulators::lc_time_flag::none}, unsigned int>}]':
cc1plus: warning: writing 2 bytes into a region of size 0
[-Wstringop-overflow=]
cc1plus: warning: writing 2 bytes into a region of size 0
[-Wstringop-overflow=]
cc1plus: warning: writing 2 bytes into a region of size 0
[-Wstringop-overflow=]
cc1plus: warning: writing 2 bytes into a region of size 0
[-Wstringop-overflow=]
cc1plus: warning: writing 2 bytes into a region of size 0
[-Wstringop-overflow=]
cc1plus: warning: writing 2 bytes into a region of size 0
[-Wstringop-overflow=]
cc1plus: warning: writing 2 bytes into a region of size 0
[-Wstringop-overflow=]
cc1plus: warning: writing 2 bytes into a region of size 0
[-Wstringop-overflow=]
cc1plus: warning: writing 2 bytes into a region of size 0
[-Wstringop-overflow=]
cc1plus: warning: writing 2 bytes into a region of size 0
[-Wstringop-overflow=]
cc1plus: warning: writing 2 bytes into a region of size 0
[-Wstringop-overflow=]



This is freestanding code to reduce size of processor file. You can just treat
printk function as printf. -ffreestanding does not affect whether the warning
would emit or not.

Do not know whether it is a false positive.

[Bug tree-optimization/102466] -O3 -fsanitize=undefined causes warnings (writing 2 bytes into a region of size 0)

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102466

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
It's very likely a false positive. We have quite some duplicates where we
explain that enabling sanitizers can lead to false-positive warnings.

[Bug tree-optimization/102466] -O3 -fsanitize=undefined causes warnings (writing 2 bytes into a region of size 0)

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102466

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
                 CC|                            |msebor at gcc dot gnu.org
   Last reconfirmed|                            |2021-09-27
             Blocks|                            |88443
             Status|UNCONFIRMED                 |NEW

--- Comment #2 from Martin Sebor <msebor at gcc dot gnu.org> ---
Confirmed.  As Martin indicated in comment #1, the UBSAN sanitization is
causing the warning to trigger.  The IL the first instance is issued for is
below (-fdump-tree-strlen):

  if (iter_554 == 0B)
    goto <bb 31>; [0.00%]
  else
    goto <bb 32>; [100.00%]

  <bb 31> [count: 0]:
  __builtin___ubsan_handle_nonnull_arg (&*.Lubsan_data478);

  <bb 32> [local count: 850510933]:
  if (_560 == 0B)
    goto <bb 33>; [0.00%]
  else
    goto <bb 34>; [100.00%]

  <bb 33> [count: 0]:
  __builtin___ubsan_handle_nonnull_arg (&*.Lubsan_data479);

  <bb 34> [local count: 850510933]:                               <<< iter_554
is null
  _565 = MEM <short unsigned int> [(char * {ref-all})_558];
  MEM <short unsigned int> [(char * {ref-all})iter_554] = _565;   <<<
-Wstringop-overflow
  .UBSAN_PTR (iter_554, 2);

The problem is likely a duplicate of one of the existing reports of the same
problem.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88443
[Bug 88443] [meta-bug] bogus/missing -Wstringop-overflow warnings

[Bug tree-optimization/102466] -O3 -fsanitize=undefined causes warnings (writing 2 bytes into a region of size 0)

[mathieu.malaterre at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102466

Mathieu Malaterre <mathieu.malaterre at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mathieu.malaterre at gmail dot com

--- Comment #3 from Mathieu Malaterre <mathieu.malaterre at gmail dot com> ---
This is also triggered in libjxl codebase:

* https://github.com/libjxl/libjxl/blob/main/tools/fuzzer_corpus.cc

/usr/include/c++/11/bits/stl_algobase.h:431:30: warning: 'void*
__builtin_memmove(void*, const void*, long unsigned int)' writing 1 or more
bytes into a region of size 0 overflows the destination [-Wstringop-overflow=]
  431 |             __builtin_memmove(__result, __first, sizeof(_Tp) * _Num);
      |             ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Bug tree-optimization/102466] -O3 -fsanitize=undefined causes warnings (writing 2 bytes into a region of size 0)

[mathieu.malaterre at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102466

--- Comment #4 from Mathieu Malaterre <mathieu.malaterre at gmail dot com> ---
I can reproduce it using -Wall -fsanitize=undefined  -O2

* https://github.com/malaterre/PublicRep/tree/master/gcc/libjxl