[Bug analyzer/105947] New: RFE: -fanalyzer should complain about jumps through NULL function pointers

[Bug analyzer/105947] New: RFE: -fanalyzer should complain about jumps through NULL function pointers

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105947

            Bug ID: 105947
           Summary: RFE: -fanalyzer should complain about jumps through
                    NULL function pointers
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
            Blocks: 105887
  Target Milestone: ---

-fanalyzer already complains about jumps through uninitialized function
pointers:

uninit-1.c: In function ‘calling_uninit_fn_ptr_2’:
uninit-1.c:140:10: warning: use of uninitialized value ‘fn_ptr’ [CWE-457]
[-Wanalyzer-use-of-uninitialized-value]
  140 |   return fn_ptr ();
      |          ^~~~~~~~~
  ‘calling_uninit_fn_ptr_2’: events 1-2
    |
    |  139 |   int (*fn_ptr) (void);
    |      |         ^~~~~~
    |      |         |
    |      |         (1) region created on stack here
    |  140 |   return fn_ptr ();
    |      |          ~~~~~~~~~
    |      |          |
    |      |          (2) use of uninitialized value ‘fn_ptr’ here
    |

but it fails to complain about jumps through NULL function pointers, e.g. it is
silent for:

$ cat gcc/testsuite/gcc.dg/analyzer/function-ptr-5.c

#define NULL ((void *)0)

void calling_null_fn_ptr_1 (void)
{
  void (*fn_ptr) (void) = NULL;
  fn_ptr ();
}

int calling_uninit_fn_ptr_2 (void)
{
  int (*fn_ptr) (void) = NULL;
  return fn_ptr ();
}

We should complain about jumps through known-to-be-NULL function pointers
(probably with a new warning e.g. -Wanalyzer-jump-through-null or somesuch).

Compare with:
 
https://clang.llvm.org/docs/analyzer/checkers.html#core-callandmessage-c-c-objc


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105887
[Bug 105887] [meta-bug] clang analyzer warnings that GCC's -fanalyzer could
implement

[Bug analyzer/105947] RFE: -fanalyzer should complain about jumps through NULL function pointers

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105947

--- Comment #1 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:e1a9168153d2bf12695844a9ca9f9fc1de8d1ddf

commit r13-1979-ge1a9168153d2bf12695844a9ca9f9fc1de8d1ddf
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Fri Aug 5 19:45:41 2022 -0400

    New warning: -Wanalyzer-jump-through-null [PR105947]

    This patch adds a new warning to -fanalyzer for jumps through NULL
    function pointers.

    gcc/analyzer/ChangeLog:
            PR analyzer/105947
            * analyzer.opt (Wanalyzer-jump-through-null): New option.
            * engine.cc (class jump_through_null): New.
            (exploded_graph::process_node): Complain about jumps through NULL
            function pointers.

    gcc/ChangeLog:
            PR analyzer/105947
            * doc/invoke.texi: Add -Wanalyzer-jump-through-null.

    gcc/testsuite/ChangeLog:
            PR analyzer/105947
            * gcc.dg/analyzer/function-ptr-5.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/105947] RFE: -fanalyzer should complain about jumps through NULL function pointers

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105947

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be implemented for GCC 13 by the above patch.