From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id 823853858C2F; Sat,  2 Jul 2022 17:08:52 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 823853858C2F
From: "cvs-commit at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug analyzer/105900] RFE: -fanalyzer could check malloc sizes when
 casting the result to a pointer
Date: Sat, 02 Jul 2022 17:08:52 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: analyzer
X-Bugzilla-Version: 12.0
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: cvs-commit at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: tlange at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-105900-4-xjTagR3Fwl@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-105900-4@http.gcc.gnu.org/bugzilla/>
References: <bug-105900-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Sat, 02 Jul 2022 17:08:52 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D105900

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Tim Lange <tlange@gcc.gnu.org>:

https://gcc.gnu.org/g:e6c3bb379f515b27268d08e62b4b3e5d7200b437

commit r13-1405-ge6c3bb379f515b27268d08e62b4b3e5d7200b437
Author: Tim Lange <mail@tim-lange.me>
Date:   Fri Jul 1 00:02:17 2022 +0200

    analyzer: add allocation size checker [PR105900]

    This patch adds an checker that warns about code paths in which a buffer
    is assigned to a incompatible type, i.e. when the allocated buffer size
    is not a multiple of the pointee's size.

    Regression-tested on x86_64 Linux. Also compiled coreutils, curl, opens=
sh
and
    httpd with the patch enabled.

    2022-07-01  Tim Lange  <mail@tim-lange.me>

    gcc/analyzer/ChangeLog:

            PR analyzer/105900
            * analyzer.opt: Added Wanalyzer-allocation-size.
            * checker-path.cc (region_creation_event::get_desc): Added call=
 to
new
            virtual function
pending_diagnostic::describe_region_creation_event.
            * checker-path.h: Added region_creation_event::get_desc.
            * diagnostic-manager.cc
(diagnostic_manager::add_event_on_final_node):
            New function.
            * diagnostic-manager.h:
            Added diagnostic_manager::add_event_on_final_node.
            * pending-diagnostic.h (struct region_creation): New event_desc
struct.
            (pending_diagnostic::describe_region_creation_event): Added vir=
tual
            function to overwrite description of a region creation.
            * region-model.cc (class dubious_allocation_size): New class.
            (capacity_compatible_with_type): New helper function.
            (class size_visitor): New class.
            (struct_or_union_with_inheritance_p): New helper function.
            (is_any_cast_p): New helper function.
            (region_model::check_region_size): New function.
            (region_model::set_value): Added call to
            region_model::check_region_size.
            * region-model.h (class region_model): New function
check_region_size.
            * svalue.cc (region_svalue::accept): Changed to post-order
traversal.
            (initial_svalue::accept): Likewise.
            (unaryop_svalue::accept): Likewise.
            (binop_svalue::accept): Likewise.
            (sub_svalue::accept): Likewise.
            (repeated_svalue::accept): Likewise.
            (bits_within_svalue::accept): Likewise.
            (widening_svalue::accept): Likewise.
            (unmergeable_svalue::accept): Likewise.
            (compound_svalue::accept): Likewise.
            (conjured_svalue::accept): Likewise.
            (asm_output_svalue::accept): Likewise.
            (const_fn_result_svalue::accept): Likewise.

    gcc/ChangeLog:

            PR analyzer/105900
            * doc/invoke.texi: Added Wanalyzer-allocation-size.

    gcc/testsuite/ChangeLog:

            PR analyzer/105900
            * gcc.dg/analyzer/pr96639.c: Changed buffer size to omit warnin=
g.
            * gcc.dg/analyzer/allocation-size-1.c: New test.
            * gcc.dg/analyzer/allocation-size-2.c: New test.
            * gcc.dg/analyzer/allocation-size-3.c: New test.
            * gcc.dg/analyzer/allocation-size-4.c: New test.
            * gcc.dg/analyzer/allocation-size-5.c: New test.

    Signed-off-by: Tim Lange <mail@tim-lange.me>=