[Bug analyzer/105906] New: fanalyzer strdup false positive leak in loop

[Bug analyzer/105906] New: fanalyzer strdup false positive leak in loop

[contino at epigenesys dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105906

            Bug ID: 105906
           Summary: fanalyzer strdup false positive leak in loop
           Product: gcc
           Version: 12.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: contino at epigenesys dot com
  Target Milestone: ---

Created attachment 53109
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53109&action=edit
The warning

Hi,
compiling the code with GCC-12.1.0 on Debian I am seeing the fanalyzer warning
in the attachment, which seems to me a false positive leak related to strdup.

Code:

#include <stddef.h>
#include <stdlib.h>
#include <string.h>

#define LEN 64

char **__epystr_explode(const char *delim, char *str)
{
        char **out = NULL;
        int i;

        if (str == NULL || delim == NULL)
                return NULL;

        out = malloc(LEN * sizeof(char *));
        if (out == NULL)
                return NULL;

        for (i = 0; i < LEN; i++) {
                out[i] = strdup("bla");
                if (out[i] == NULL)
                        goto freem;
        }
        return out;

freem:
        while (--i >= 0)
                free(out[i]);
        free(out);
        return NULL;
}

If I replace strdup with malloc the warning disappears.

for (i = 0; i < LEN; i++) {
        out[i] = malloc(10);
        if (out[i] == NULL)
                goto freem;
}

The same happens if I replace the for loop with a goto loop.

i = 0;
loop:
out[i] = strdup("bla");
if (out[i] == NULL)
        goto freem;
i++
if (i < LEN)
        goto loop;

[Bug analyzer/105906] fanalyzer strdup false positive leak in loop

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105906

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2022-06-10
     Ever confirmed|0                           |1

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug.

Confirmed, and it still affects trunk: reproducer here:
  https://godbolt.org/z/P43bbMMW7

[Bug analyzer/105906] fanalyzer strdup false positive leak in loop

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105906

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Looks like this is fixed on trunk for GCC 13; seem to have been via
688fc162b76dc6747a30fcfd470f4770da0f4924

[Bug analyzer/105906] fanalyzer strdup false positive leak in loop

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105906

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
(In reply to David Malcolm from comment #2)
> Looks like this is fixed on trunk for GCC 13; seem to have been via
> 688fc162b76dc6747a30fcfd470f4770da0f4924

aka r13-5113-g688fc162b76dc6

[Bug analyzer/105906] fanalyzer strdup false positive leak in loop

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105906

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:23532dac3f602d6c29f5b7062c7fe30905061764

commit r13-6641-g23532dac3f602d6c29f5b7062c7fe30905061764
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Mar 13 14:53:05 2023 -0400

    testsuite: add test coverage for analyzer leak false +ve [PR105906]

    Adding regression test coverage; I believe I fixed this leak
    false positive with r13-5113-g688fc162b76dc6.

    gcc/testsuite/ChangeLog:
            PR analyzer/105906
            * gcc.dg/analyzer/leak-pr105906.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>