[Bug analyzer/104042] New: Four memcpy/memset analyzer failures on darwin

[Bug analyzer/104042] New: Four memcpy/memset analyzer failures on darwin

[fxcoudert at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104042

            Bug ID: 104042
           Summary: Four memcpy/memset analyzer failures on darwin
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: fxcoudert at gcc dot gnu.org
  Target Milestone: ---

Created attachment 52202
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52202&action=edit
Preprocessed source

Some analyzer testcases fail on darwin
(https://gcc.gnu.org/pipermail/gcc-testresults/2022-January/747918.html) due to
what I believe are false positive.

Those four cases fail for the same reason:

gcc.dg/analyzer/data-model-1.c
gcc.dg/analyzer/pr103526.c
gcc.dg/analyzer/taint-size-1.c
gcc.dg/analyzer/write-to-string-literal-1.c

The failures are related to memcpy and memset, and can be reduced to this:

$ cat write-to-string-literal-1.c 
#include <string.h>

void test_2 (void) {
  memcpy ("abc", "def", 3); /* { dg-warning "write to string literal" } */
}
$ ./bin/gcc -fdiagnostics-plain-output -fanalyzer -Wanalyzer-too-complex
-fanalyzer-call-summaries write-to-string-literal-1.c -c

No warning is emitted, and the test expects a warning. The preprocessed source
for this reduced testcase is attached.


The testcase passes if the memcpy() call is replaced by __builtin_memcpy().

[Bug analyzer/104042] Four memcpy/memset analyzer failures on darwin

[fxcoudert at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104042

Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2022-01-15
                 CC|                            |dmalcolm at gcc dot gnu.org,
                   |                            |iains at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #1 from Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> ---
The reason for the failure is that the darwin headers, in <secure/_string.h>
(included from <string.h>), defines memcpy like this:

#if __has_builtin(__builtin___memcpy_chk) || defined(__GNUC__)
#undef memcpy
/* void *memcpy(void *dst, const void *src, size_t n) */
#define memcpy(dest, ...) \
               __builtin___memcpy_chk (dest, __VA_ARGS__, __darwin_obsz0
(dest))
#endif

where __darwin_obsz0 is defined thusly:

#define __darwin_obsz0(object) __builtin_object_size (object, 0)



So either the testcase should be modified to use __builtin_memcpy, or the
analyzer should handle __builtin___memcpy_chk and emit the right warning.

[Bug analyzer/104042] Four memcpy/memset analyzer failures on darwin

[iains at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104042

--- Comment #2 from Iain Sandoe <iains at gcc dot gnu.org> ---
FX, You might be able to force Darwin to use the non-checked versions (perhaps
by adding -D_USE_FORTIFY_LEVEL=0)

[Bug analyzer/104042] Four memcpy/memset analyzer failures on darwin

[iains at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104042

--- Comment #3 from Iain Sandoe <iains at gcc dot gnu.org> ---
erm, that is probably _FORTIFY_SOURCE from the command line.

[Bug analyzer/104042] Four memcpy/memset analyzer failures on darwin

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104042

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
So I suspect they will fail if you default the linux compiler to
_FORTIFY_SOURCE=2 then too. (I thought there was a configure option to do that
or maybe Debian/Ubuntu has patches for it I forget).

[Bug analyzer/104042] Four memcpy/memset analyzer failures on darwin

[fxcoudert at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104042

--- Comment #5 from Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> ---
Patch posted for Darwin at
https://gcc.gnu.org/pipermail/gcc-patches/2023-August/627923.html

[Bug analyzer/104042] Four memcpy/memset analyzer failures on darwin

[fxcoudert at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104042

Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Build|                            |x86_64-apple-darwin21
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED
             Target|                            |x86_64-apple-darwin21
               Host|                            |x86_64-apple-darwin21

--- Comment #6 from Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> ---
Fixed on mainline.

[Bug analyzer/104042] Four memcpy/memset analyzer failures on darwin

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104042

--- Comment #7 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Iain D Sandoe
<iains@gcc.gnu.org>:

https://gcc.gnu.org/g:a5bc8abef90874e81783e0fa34db133da71d1133

commit r13-8548-ga5bc8abef90874e81783e0fa34db133da71d1133
Author: Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
Date:   Sat Aug 19 23:22:06 2023 +0200

    Testsuite: fix analyzer tests on Darwin

    On macOS, system headers redefine by default some macros (memcpy,
    memmove, etc) to checked versions, which defeats the analyzer. We
    want to turn this off.
    See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104042

    gcc/testsuite/ChangeLog:

            PR analyzer/104042
            * gcc.dg/analyzer/analyzer.exp: Pass -D_FORTIFY_SOURCE=0 on Darwin.
            * gcc.dg/analyzer/fd-bind.c: Add missing <string.h> header.
            * gcc.dg/analyzer/fd-datagram-socket.c: Likewise.
            * gcc.dg/analyzer/fd-listen.c: Likewise.
            * gcc.dg/analyzer/fd-socket-misuse.c: Likewise.
            * gcc.dg/analyzer/fd-stream-socket-active-open.c: Likewise.
            * gcc.dg/analyzer/fd-stream-socket-passive-open.c: Likewise.
            * gcc.dg/analyzer/fd-stream-socket.c: Likewise.
            * gcc.dg/analyzer/fd-symbolic-socket.c: Likewise.

    (cherry picked from commit ce33bbfcbc7dd3afc6c96fb48a19ed00f0c598ce)

[Bug analyzer/104042] Four memcpy/memset analyzer failures on darwin

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104042

--- Comment #8 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Iain D Sandoe
<iains@gcc.gnu.org>:

https://gcc.gnu.org/g:c2cb625eb141cacd0bee6c6ce5888d673ac38ca4

commit r12-10361-gc2cb625eb141cacd0bee6c6ce5888d673ac38ca4
Author: Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
Date:   Sat Aug 19 23:22:06 2023 +0200

    Testsuite: fix analyzer tests on Darwin

    On macOS, system headers redefine by default some macros (memcpy,
    memmove, etc) to checked versions, which defeats the analyzer. We
    want to turn this off.
    See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104042

    gcc/testsuite/ChangeLog:

            PR analyzer/104042
            * gcc.dg/analyzer/analyzer.exp: Pass -D_FORTIFY_SOURCE=0 on Darwin.

    (cherry picked from commit ce33bbfcbc7dd3afc6c96fb48a19ed00f0c598ce)

[Bug analyzer/104042] Four memcpy/memset analyzer failures on darwin

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104042

--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Iain D Sandoe
<iains@gcc.gnu.org>:

https://gcc.gnu.org/g:ee2f7a02371aba24f6db6231ae862cd2248bf45f

commit r11-11393-gee2f7a02371aba24f6db6231ae862cd2248bf45f
Author: Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
Date:   Sat Aug 19 23:22:06 2023 +0200

    Testsuite: fix analyzer tests on Darwin

    On macOS, system headers redefine by default some macros (memcpy,
    memmove, etc) to checked versions, which defeats the analyzer. We
    want to turn this off.
    See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104042

    gcc/testsuite/ChangeLog:

            PR analyzer/104042
            * gcc.dg/analyzer/analyzer.exp: Pass -D_FORTIFY_SOURCE=0 on Darwin.

    (cherry picked from commit ce33bbfcbc7dd3afc6c96fb48a19ed00f0c598ce)