From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id BAC06385E455; Thu, 27 Jan 2022 23:04:14 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org BAC06385E455 From: "cvs-commit at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug analyzer/104224] Testcases for analyzer "uninit" from fedora-devel Date: Thu, 27 Jan 2022 23:04:14 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: analyzer X-Bugzilla-Version: 12.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: cvs-commit at gcc dot gnu.org X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: dmalcolm at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: gcc-bugs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-bugs mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Jan 2022 23:04:14 -0000 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D104224 --- Comment #3 from CVS Commits --- The master branch has been updated by David Malcolm : https://gcc.gnu.org/g:00e7d024afb80e95fb36d74b1c059468d883a850 commit r12-6906-g00e7d024afb80e95fb36d74b1c059468d883a850 Author: David Malcolm Date: Wed Jan 26 16:24:08 2022 -0500 analyzer: show region creation events for uninit warnings When reviewing the output of -fanalyzer on PR analyzer/104224 I noticed that despite very verbose paths, the diagnostic paths for -Wanalyzer-use-of-uninitialized-value don't show where the uninitialized memory is allocated. This patch adapts and simplifies material from "[PATCH 3/6] analyzer: implement infoleak detection" https://gcc.gnu.org/pipermail/gcc-patches/2021-November/584377.html in order to add region creation events for the pertinent region (whether on the stack or heap). For example, this patch extends: malloc-1.c: In function 'test_40': malloc-1.c:461:5: warning: use of uninitialized value '*p' [CWE-457] [-Wanalyzer-use-of-uninitialized-value] 461 | i =3D *p; | ~~^~~~ 'test_40': event 1 | | 461 | i =3D *p; | | ~~^~~~ | | | | | (1) use of uninitialized value '*p' here | to: malloc-1.c: In function 'test_40': malloc-1.c:461:5: warning: use of uninitialized value '*p' [CWE-457] [-Wanalyzer-use-of-uninitialized-value] 461 | i =3D *p; | ~~^~~~ 'test_40': events 1-2 | | 460 | int *p =3D (int*)malloc(sizeof(int*)); | | ^~~~~~~~~~~~~~~~~~~~ | | | | | (1) region created on heap here | 461 | i =3D *p; | | ~~~~~~ | | | | | (2) use of uninitialized value '*p' here | and this helps readability of the resulting warnings, especially in more complicated cases. gcc/analyzer/ChangeLog: * checker-path.cc (event_kind_to_string): Handle EK_REGION_CREATION. (region_creation_event::region_creation_event): New. (region_creation_event::get_desc): New. (checker_path::add_region_creation_event): New. * checker-path.h (enum event_kind): Add EK_REGION_CREATION. (class region_creation_event): New subclass. (checker_path::add_region_creation_event): New decl. * diagnostic-manager.cc (diagnostic_manager::emit_saved_diagnostic): Pass NULL for new param to add_events_for_eedge when handling trailing eedge. (diagnostic_manager::build_emission_path): Create an interestin= g_t instance, allow the pending diagnostic to populate it, and pass= it to the calls to add_events_for_eedge. (diagnostic_manager::add_events_for_eedge): Add "interest" para= m. Use it to add region_creation_events for on-stack regions creat= ed within at function entry, and when pertinent dynamically-sized regions are created. (diagnostic_manager::prune_for_sm_diagnostic): Add case for EK_REGION_CREATION. * diagnostic-manager.h (diagnostic_manager::add_events_for_eedg= e): Add "interest" param. * pending-diagnostic.cc: Include "selftest.h", "tristate.h", "analyzer/call-string.h", "analyzer/program-point.h", "analyzer/store.h", and "analyzer/region-model.h". (interesting_t::add_region_creation): New. (interesting_t::dump_to_pp): New. * pending-diagnostic.h (struct interesting_t): New. (pending_diagnostic::mark_interesting_stuff): New vfunc. * region-model.cc (poisoned_value_diagnostic::poisoned_value_diagnostic): Add (poisoned_value_diagnostic::operator=3D=3D): Compare m_pkind and m_src_region fields. (poisoned_value_diagnostic::mark_interesting_stuff): New. (poisoned_value_diagnostic::m_src_region): New. (region_model::check_for_poison): Call get_region_for_poisoned_expr for uninit values and pass the res= ul to the diagnostic. (region_model::get_region_for_poisoned_expr): New. (region_model::deref_rvalue): Pass NULL for poisoned_value_diagnostic's src_region. * region-model.h (region_model::get_region_for_poisoned_expr): = New decl. * region.h (frame_region::get_fndecl): New. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/data-model-1.c: Add dg-message directives for expected region creation events. * gcc.dg/analyzer/malloc-1.c: Likewise. * gcc.dg/analyzer/memset-CVE-2017-18549-1.c: Likewise. * gcc.dg/analyzer/pr101547.c: Likewise. * gcc.dg/analyzer/pr101875.c: Likewise. * gcc.dg/analyzer/pr101962.c: Likewise. * gcc.dg/analyzer/pr104224.c: Likewise. * gcc.dg/analyzer/pr94047.c: Likewise. * gcc.dg/analyzer/symbolic-1.c: Likewise. * gcc.dg/analyzer/uninit-1.c: Likewise. * gcc.dg/analyzer/uninit-4.c: Likewise. * gcc.dg/analyzer/uninit-alloca.c: New test. * gcc.dg/analyzer/uninit-pr94713.c: Add dg-message directive for expected region creation event. * gcc.dg/analyzer/uninit-pr94714.c: Likewise. * gcc.dg/analyzer/zlib-3.c: Likewise. Signed-off-by: David Malcolm =