public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
From: "slyfox at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org> To: gcc-bugs@gcc.gnu.org Subject: [Bug c/104069] New: -Werror=use-after-free false positive on elfutils-0.186 Date: Mon, 17 Jan 2022 17:18:52 +0000 [thread overview] Message-ID: <bug-104069-4@http.gcc.gnu.org/bugzilla/> (raw) https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104069 Bug ID: 104069 Summary: -Werror=use-after-free false positive on elfutils-0.186 Product: gcc Version: 12.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: c Assignee: unassigned at gcc dot gnu.org Reporter: slyfox at gcc dot gnu.org CC: dmalcolm at gcc dot gnu.org Target Milestone: --- Originally observed on elfutils-0.186 (which builds with -Werror by default). Here is my attempt to extract simplified example: typedef long unsigned int size_t; extern void *realloc(void *__ptr, size_t __size) __attribute__((__nothrow__, __leaf__)) __attribute__((__warn_unused_result__)) __attribute__((__alloc_size__(2))); void * __libdw_unzstd(size_t todo) { void * sb = 0; for(;;) { // ran ony once if (!sb) { char * b = realloc(sb, todo); if (!b) break; sb = b; } todo -= 1; if (todo == 0) break; } // shrink buffer: leave only one byte for simplicity char * b = realloc(sb, 1); if (b) { sb = b; } else { // realloc failed mysteriously, leave 'sb' untouched. } return sb; } $ gcc-12.0.0 -O2 -std=gnu99 -Wall -Werror -c zstd.c.c zstd.c.c: In function ‘__libdw_unzstd’: zstd.c.c:35:10: error: pointer ‘sb’ may be used after ‘realloc’ [-Werror=use-after-free] 35 | return sb; | ^~ zstd.c.c:28:14: note: call to ‘realloc’ here 28 | char * b = realloc(sb, 1); | ^~~~~~~~~~~~~~ cc1: all warnings being treated as errors I think it's a proper false positive. Original code is not as contrived (but I think it's still correct): https://sourceware.org/git/?p=elfutils.git;a=blob;f=libdwfl/gzip.c;h=ba8ecfba6c316b261ee38bb288ab163664ade9e5;hb=983e86fd89e8bf02f2d27ba5dce5bf078af4ceda#l180 $ gcc-12.0.0 -v Using built-in specs. COLLECT_GCC=/<<NIX>>/gcc-12.0.0/bin/gcc COLLECT_LTO_WRAPPER=/<<NIX>>/gcc-12.0.0/libexec/gcc/x86_64-unknown-linux-gnu/12.0.0/lto-wrapper Target: x86_64-unknown-linux-gnu Configured with: Thread model: posix Supported LTO compression algorithms: zlib gcc version 12.0.0 20220116 (experimental) (GCC)
next reply other threads:[~2022-01-17 17:18 UTC|newest] Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-01-17 17:18 slyfox at gcc dot gnu.org [this message] 2022-01-17 17:27 ` [Bug tree-optimization/104069] " pinskia at gcc dot gnu.org 2022-01-17 17:29 ` slyfox at gcc dot gnu.org 2022-01-17 19:10 ` msebor at gcc dot gnu.org 2022-01-17 21:52 ` msebor at gcc dot gnu.org 2022-01-18 9:37 ` slyfox at gcc dot gnu.org 2022-01-18 22:03 ` msebor at gcc dot gnu.org 2022-01-18 22:06 ` [Bug middle-end/104069] " msebor at gcc dot gnu.org 2022-01-18 22:17 ` jakub at gcc dot gnu.org 2022-01-18 22:47 ` msebor at gcc dot gnu.org 2022-01-18 22:56 ` jakub at gcc dot gnu.org 2022-01-19 0:51 ` amacleod at redhat dot com 2022-01-19 1:04 ` cvs-commit at gcc dot gnu.org 2022-01-19 20:22 ` msebor at gcc dot gnu.org 2022-01-19 20:24 ` msebor at gcc dot gnu.org 2022-01-19 20:30 ` pinskia at gcc dot gnu.org 2022-01-19 20:31 ` pinskia at gcc dot gnu.org 2022-01-19 20:32 ` msebor at gcc dot gnu.org 2022-01-19 20:34 ` jakub at gcc dot gnu.org 2022-01-19 20:42 ` jakub at gcc dot gnu.org 2022-01-19 20:54 ` msebor at gcc dot gnu.org 2022-01-31 11:18 ` jakub at gcc dot gnu.org 2022-03-17 19:32 ` msebor at gcc dot gnu.org 2022-05-16 14:14 ` eike@sf-mail.de 2022-08-24 8:51 ` vincent at systemli dot org 2022-10-27 16:57 ` mark at gcc dot gnu.org 2022-10-28 7:36 ` slyfox at gcc dot gnu.org 2023-05-10 3:35 ` [Bug middle-end/104069] Wuse-after-free=2 -O0 false positive "may be used" mkaracsony81 at gmail dot com 2023-05-12 7:00 ` slyfox at gcc dot gnu.org 2023-05-12 8:30 ` mkaracsony81 at gmail dot com 2023-05-12 9:08 ` slyfox at gcc dot gnu.org 2023-05-12 13:20 ` mkaracsony81 at gmail dot com 2023-05-12 20:36 ` slyfox at gcc dot gnu.org 2023-05-13 5:07 ` mkaracsony81 at gmail dot com 2023-05-13 5:07 ` mkaracsony81 at gmail dot com 2023-12-17 4:40 ` lavr at ncbi dot nlm.nih.gov
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-104069-4@http.gcc.gnu.org/bugzilla/ \ --to=gcc-bugzilla@gcc.gnu.org \ --cc=gcc-bugs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).