[Bug analyzer/102695] New: missing -Wanalyzer-write-to-const for writing to string, function, label, or const member

[Bug analyzer/102695] New: missing -Wanalyzer-write-to-const for writing to string, function, label, or const member

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102695

            Bug ID: 102695
           Summary: missing -Wanalyzer-write-to-const for writing to
                    string, function, label, or const member
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: msebor at gcc dot gnu.org
  Target Milestone: ---

Below are a few C test cases from my tests for the solution for pr90404 that I
noticed the analyzer doesn't issue warnings for but could and probably should.

$ cat z.c && gcc -S -Wall -fanalyzer z.c
extern void* malloc (__SIZE_TYPE__);

const char* write_strchr_literal (int x)
{
  char *p = __builtin_strchr ("123", x);
  *p = 0;   // missing warning
  return p;
}

const char* write_strchr_const_array (int x)
{
  static const char a[] = "123";
  char *p = __builtin_strchr (a, x);
  *p = 0;   // missing warning
  return a;
}

char* write_function (void)
{
  char *p = (char*)malloc /* forgot arguments */;
  __builtin_strcpy (p, "123");   // missing warning
  return p;
}

char* write_label (void)
{
  char *p = (char*)&&L;
  *p = 0;   // missing warning
L:
  return p;
}

struct A { const int i; };

extern /* not const */ struct A a;

void write_const_member (void)
{
  char *p = (char*)&a.i;
  *p = 0;   // missing warning
}

[Bug analyzer/102695] missing -Wanalyzer-write-to-const for writing to string, function, label, or const member

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102695

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-11-16

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Am testing a fix

[Bug analyzer/102695] missing -Wanalyzer-write-to-const for writing to string, function, label, or const member

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102695

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:111fd515f2894d7cddf62f80c69765c43ae18577

commit r12-5330-g111fd515f2894d7cddf62f80c69765c43ae18577
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Tue Nov 16 10:36:49 2021 -0500

    analyzer: fix missing -Wanalyzer-write-to-const [PR102695]

    This patch fixes -Wanalyzer-write-to-const so that it will complain
    about attempts to write to functions, to labels.
    It also "teaches" the analyzer about strchr, in that strchr can either
    return a pointer into the input area (and thus -Wanalyzer-write-to-const
    can now complain about writes into a string literal seen this way),
    or return NULL (and thus the analyzer can complain about NULL
    dereferences if the result is used without a check).

    gcc/analyzer/ChangeLog:
            PR analyzer/102695
            * region-model-impl-calls.cc (region_model::impl_call_strchr): New.
            * region-model-manager.cc
            (region_model_manager::maybe_fold_unaryop): Simplify cast to
            pointer type of an existing pointer to a region.
            * region-model.cc (region_model::on_call_pre): Handle
            BUILT_IN_STRCHR and "strchr".
            (write_to_const_diagnostic::emit): Add auto_diagnostic_group.  Add
            alternate wordings for functions and labels.
            (write_to_const_diagnostic::describe_final_event): Add alternate
            wordings for functions and labels.
            (region_model::check_for_writable_region): Handle RK_FUNCTION and
            RK_LABEL.
            * region-model.h (region_model::impl_call_strchr): New decl.

    gcc/testsuite/ChangeLog:
            PR analyzer/102695
            * gcc.dg/analyzer/pr102695.c: New test.
            * gcc.dg/analyzer/strchr-1.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/102695] missing -Wanalyzer-write-to-const for writing to string, function, label, or const member

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102695

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
The above patch implements detection for all of the cases in comment #0 apart
from write_const_member; I don't plan to implement detection of that, so
marking this as resolved.