[Bug tree-optimization/104119] New: Wrong -Werror=format-overflow= since r12-5014-g6b8b959675a3e14c

[Bug tree-optimization/104119] New: Wrong -Werror=format-overflow= since r12-5014-g6b8b959675a3e14c

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104119

            Bug ID: 104119
           Summary: Wrong -Werror=format-overflow= since
                    r12-5014-g6b8b959675a3e14c
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: aldyh at gcc dot gnu.org, amacleod at redhat dot com
  Target Milestone: ---

Since the revision I see (reduced from multipath-tools package)

$ cat devmapper.i
struct {
  char id[8];
  int needs_paths_uevent;
} *p;

void dm_addmap_create()
{
  char *str = __builtin_malloc((sizeof("mpath-") - 1) + __builtin_strlen(p->id)
+ 10);
  __builtin_sprintf(str, "mpath-%s", p->id);
}

$ gcc devmapper.i -c -m32 -O2 -Werror=format-overflow
devmapper.i: In function ‘dm_addmap_create’:
devmapper.i:9:33: error: ‘%s’ directive writing up to 2147483644 bytes into a
region of size 2147483641 [-Werror=format-overflow=]
    9 |   __builtin_sprintf(str, "mpath-%s", p->id);
      |                                 ^~
devmapper.i:9:3: note: ‘__builtin_sprintf’ output between 7 and 2147483651
bytes into a destination of size 2147483647
    9 |   __builtin_sprintf(str, "mpath-%s", p->id);
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: some warnings being treated as errors

Note one needs -m32!

[Bug tree-optimization/104119] Wrong -Werror=format-overflow= since r12-5014-g6b8b959675a3e14c

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104119

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2022-01-19

[Bug tree-optimization/104119] unexpected -Wformat-overflow after strlen in ILP32 since Ranger integration

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104119

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |diagnostic
            Summary|Wrong                       |unexpected
                   |-Werror=format-overflow=    |-Wformat-overflow after
                   |since                       |strlen in ILP32 since
                   |r12-5014-g6b8b959675a3e14c  |Ranger integration
             Blocks|                            |85741

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
There is a subtle difference between GCC 11 and GCC 12 in the range determined
for the length of the string argument to the %s directive that causes the
warning to trigger.  In GCC 11, EVRP reports it's [0, 2147483645] while in GCC
12 Ranger reports it's [0, 2147483644].  The difference of 1 between the upper
bounds is due to the improved range info (in both GCC 11 and 12 the strlen pass
sets the upper bound to 2147483644 but only in GCC 12 does Ranger report the
strlen result).

That being said, for the purposes of warning (but not optimization), when the
string length cannot be accurately determined, I think the sprintf pass should
use the size of the array the string is stored in.  So the warning in this case
should assume the result of strlen(p->id) is in [0, 7].  That would avoid it in
this instance and probably in quite a few others.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85741
[Bug 85741] [meta-bug] bogus/missing -Wformat-overflow

[Bug tree-optimization/104119] unexpected -Wformat-overflow after strlen in ILP32 since Ranger integration

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104119

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|                            |ILP32
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=96367

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Hmm, very similar to PR 96367.

[Bug tree-optimization/104119] [12 Regression] unexpected -Wformat-overflow after strlen in ILP32 since Ranger integration

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104119

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
            Summary|unexpected                  |[12 Regression] unexpected
                   |-Wformat-overflow after     |-Wformat-overflow after
                   |strlen in ILP32 since       |strlen in ILP32 since
                   |Ranger integration          |Ranger integration
           Assignee|unassigned at gcc dot gnu.org      |msebor at gcc dot gnu.org

--- Comment #3 from Martin Sebor <msebor at gcc dot gnu.org> ---
Let me try to handle this for GCC 12.

[Bug tree-optimization/104119] [12 Regression] unexpected -Wformat-overflow after strlen in ILP32 since Ranger integration

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104119

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch

--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> ---
Patch: https://gcc.gnu.org/pipermail/gcc-patches/2022-January/588909.html

[Bug tree-optimization/104119] [12 Regression] unexpected -Wformat-overflow after strlen in ILP32 since Ranger integration

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104119

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.0
           Priority|P3                          |P1

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
I think the issue is that we saturate the buffer length but then subtract
"mpath-" from that.

[Bug tree-optimization/104119] [12 Regression] unexpected -Wformat-overflow after strlen in ILP32 since Ranger integration

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104119

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:3c9f762ad02f398c27275688c3494332f69237f5

commit r12-7033-g3c9f762ad02f398c27275688c3494332f69237f5
Author: Martin Sebor <msebor@redhat.com>
Date:   Thu Feb 3 13:27:16 2022 -0700

    Constrain conservative string lengths to array sizes [PR104119].

    Resolves:
    PR tree-optimization/104119 - unexpected -Wformat-overflow after strlen in
ILP32 since Ranger integration

    gcc/ChangeLog:

            PR tree-optimization/104119
            * gimple-ssa-sprintf.cc (struct directive): Change argument type.
            (format_none): Same.
            (format_percent): Same.
            (format_integer): Same.
            (format_floating): Same.
            (get_string_length): Same.
            (format_character): Same.
            (format_string): Same.
            (format_plain): Same.
            (format_directive): Same.
            (compute_format_length): Same.
            (handle_printf_call): Same.
            * tree-ssa-strlen.cc (get_range_strlen_dynamic): Same.   Call
            get_maxbound.
            (get_range_strlen_phi): Same.
            (get_maxbound): New function.
            (strlen_pass::get_len_or_size): Adjust to parameter change.
            * tree-ssa-strlen.h (get_range_strlen_dynamic): Change argument
type.

    gcc/testsuite/ChangeLog:

            PR tree-optimization/104119
            * gcc.dg/tree-ssa/builtin-snprintf-13.c: New test.
            * gcc.dg/tree-ssa/builtin-sprintf-warn-29.c: New test.

[Bug tree-optimization/104119] [12 Regression] unexpected -Wformat-overflow after strlen in ILP32 since Ranger integration

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104119

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #7 from Martin Sebor <msebor at gcc dot gnu.org> ---
The warning has been avoided in this case by using the size of the source array
as the upper bound.  The heuristic the warning uses is still in place so when
the size of the source array isn't known (e.g., when it's a flexible array
member) it will still trigger.