[Bug analyzer/105898] New: RFE: -fanalyzer should complain about overlapping args to memcpy and mempcpy

[Bug analyzer/105898] New: RFE: -fanalyzer should complain about overlapping args to memcpy and mempcpy

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105898

            Bug ID: 105898
           Summary: RFE: -fanalyzer should complain about overlapping args
                    to memcpy and mempcpy
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
            Blocks: 105887
  Target Milestone: ---

See:
 
https://clang.llvm.org/docs/analyzer/checkers.html#alpha-unix-cstring-bufferoverlap-c

Seems fairly easy to detect the "definitely overlaps" case with the region
model.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105887
[Bug 105887] RFE: clang analyzer warnings that GCC's -fanalyzer could implement

[Bug analyzer/105898] RFE: -fanalyzer should complain about overlapping args to memcpy and mempcpy

[egallager at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105898

Eric Gallager <egallager at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |egallager at gcc dot gnu.org

--- Comment #1 from Eric Gallager <egallager at gcc dot gnu.org> ---
Doesn't -Wrestrict already kinda do this?

[Bug analyzer/105898] RFE: -fanalyzer should complain about overlapping args to memcpy and mempcpy

[tlange at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105898

Tim Lange <tlange at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tlange at gcc dot gnu.org

--- Comment #2 from Tim Lange <tlange at gcc dot gnu.org> ---
(In reply to Eric Gallager from comment #1)
> Doesn't -Wrestrict already kinda do this?

Partly. -Wrestrict only warns when you actually use the same variable, e.g.
memcpy (buf, buf, 4).

Doing that in the analyzer could also warn on cases like:
- memcpy (buf, alias_to_buf, 4)
- memcpy (buf, buf + 2, 4)

[Bug analyzer/105898] RFE: -fanalyzer should complain about overlapping args to memcpy and mempcpy

[tlange at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105898

--- Comment #3 from Tim Lange <tlange at gcc dot gnu.org> ---
This checker is nearly finished, but is blocked by:
  https://gcc.gnu.org/pipermail/gcc/2022-July/239213.html

tl;dr: the current draft of the C standard does include new examples of how the
restrict keyword should be handled and states that two restrict-qualified
parameters are allowed to alias if they are never written in the body. Neither
my checker nor Wrestrict does check that at the moment. We yet have to decide
how to proceed with this checker.

[Bug analyzer/105898] RFE: -fanalyzer should complain about overlapping args to memcpy and mempcpy

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105898

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
I implemented this a different way, for memcpy, in r14-3556-g034d99e81484fb (by
special-casing it).

We don't yet check mempcpy, wmemcpy, or wmempcp; keeping bug open to handle
those.

[Bug analyzer/105898] RFE: -fanalyzer should complain about overlapping args to mempcpy, wmemcpy, and wmempcpy

[egallager at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105898

Eric Gallager <egallager at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|RFE: -fanalyzer should      |RFE: -fanalyzer should
                   |complain about overlapping  |complain about overlapping
                   |args to memcpy and mempcpy  |args to mempcpy, wmemcpy,
                   |                            |and wmempcpy

--- Comment #5 from Eric Gallager <egallager at gcc dot gnu.org> ---
(In reply to David Malcolm from comment #4)
> I implemented this a different way, for memcpy, in r14-3556-g034d99e81484fb
> (by special-casing it).
> 
> We don't yet check mempcpy, wmemcpy, or wmempcp; keeping bug open to handle
> those.

Retitling.