[Bug c/102810] New: Bogus Wstringop-overread warning when special (integer) pointer values passed to array parameter of a function

[Bug c/102810] New: Bogus Wstringop-overread warning when special (integer) pointer values passed to array parameter of a function

[ian at abbott dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102810

            Bug ID: 102810
           Summary: Bogus Wstringop-overread warning when special
                    (integer) pointer values passed to array parameter of
                    a function
           Product: gcc
           Version: 11.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: ian at abbott dot org
  Target Milestone: ---

I don't know why this code produces a Wstringop-overread warning since it has
nothing to do with string operations.  Also, why is there a warning for
argument 2, but not for argument 1?

extern int foo(const int *a, const int b[]);

#define SPECIAL ((int *)2)

int main(void)
{
    foo(SPECIAL, SPECIAL);
}

int foo(const int a[], const int b[])
{
    return 0;
}

<source>: In function 'main':
<source>:7:5: warning: 'foo' reading 4 bytes from a region of size 0
[-Wstringop-overread]
    7 |     foo(SPECIAL, SPECIAL);
      |     ^~~~~~~~~~~~~~~~~~~~~
<source>:7:5: note: referencing argument 2 of type 'const int *'
<source>:10:5: note: in a call to function 'foo'
   10 | int foo(const int a[], const int b[])
      |     ^~~

[Bug middle-end/102810] [11/12 Regression] Bogus Wstringop-overread passing a smaller array to an array parameter without a bound

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102810

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |msebor at gcc dot gnu.org
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-10-18
          Component|c                           |middle-end
            Summary|Bogus Wstringop-overread    |[11/12 Regression] Bogus
                   |warning when special        |Wstringop-overread passing
                   |(integer) pointer values    |a smaller array to an array
                   |passed to array parameter   |parameter without a bound
                   |of a function               |
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
GCC issues the -Wstringop-xxx warnings in this context only because there isn't
a more appropriate option yet.  One should be added.

The warning for argument 2 is a bug.  With -Warray-parameter enabled, for the
purposes of out-of-bounds access detection, GCC treats function parameters
declared using the array form (as in void f (int a[2]);) as an indication that
the function expects an array argument with at least as many elements.  A bug
in the code applies the same logic to an array parameter declared with no
bounds, as in the example.  I confirm this report for this problem.

With the following snippet, a read access warning should only be expected for
the third argument:

extern int foo(const int *a, const int b[], const int c[1]);

int main (void)
{
  foo ((int*)2, (int*)2, (int*2));
}

The warning in this instance is issued because functions that take const array
parameters with non-zero bound are assumed to read as many elements from the
parameters as the bound indicates.  Because (int*)2 is not a pointer to an
array with at least two elements (or a valid pointer at all), the warning
triggers.

(Note that using invalid pointers like (int*)2 in any expression, including
assigning them to function parameters, is undefined and may be diagnosed in the
future regardless of the context they're used in, including in in arguments 1
and 2 above.)

[Bug middle-end/102810] [11/12 Regression] Bogus Wstringop-overread passing a smaller array to an array parameter without a bound

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102810

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|https://stackoverflow.com/q |
                   |/69583120/5264491           |
   Target Milestone|---                         |11.3

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
https://stackoverflow.com/q/69583120/5264491

[Bug middle-end/102810] [11/12 Regression] Bogus Wstringop-overread passing a smaller array to an array parameter without a bound

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102810

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug middle-end/102810] [11/12 Regression] Bogus Wstringop-overread passing a smaller array to an array parameter without a bound

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102810

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.3                        |11.4

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 11.3 is being released, retargeting bugs to GCC 11.4.

[Bug middle-end/102810] [11/12/13/14 Regression] Bogus Wstringop-overread passing a smaller array to an array parameter without a bound

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102810

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.4                        |11.5

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 11.4 is being released, retargeting bugs to GCC 11.5.