public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/106225] New: False positives from -Wanalyzer-tainted-divisor
@ 2022-07-07 14:05 dmalcolm at gcc dot gnu.org
  2022-07-07 15:48 ` [Bug analyzer/106225] " dmalcolm at gcc dot gnu.org
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2022-07-07 14:05 UTC (permalink / raw)
  To: gcc-bugs

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106225

            Bug ID: 106225
           Summary: False positives from -Wanalyzer-tainted-divisor
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
  Target Milestone: ---

-Wanalyzer-tainted-divisor seems to be using the wrong logic for determining if
a value has been checked for zeroness; consider:

#include <stdio.h>

struct st1
{
  int a;
  int b;
};

int test_checked_ne_zero (FILE *f)
{
  struct st1 s;
  fread (&s, sizeof (s), 1, f);
  if (s.b)
    return s.a / s.b;
  else
    return 0;
}

for which (with -fanalyzer -fanalyzer-checker=taint) trunk and gcc 12.1
erroneously emit:

<source>: In function 'test_checked_ne_zero':
<source>:14:16: warning: use of attacker-controlled value 's.b' as divisor
without checking for zero [CWE-369] [-Wanalyzer-tainted-divisor]
   14 |     return s.a / s.b;
      |            ~~~~^~~~~
  'test_checked_ne_zero': events 1-3
    |
    |   13 |   if (s.b)
    |      |      ^
    |      |      |
    |      |      (1) following 'true' branch...
    |   14 |     return s.a / s.b;
    |      |            ~~~~~~~~~
    |      |             |  |
    |      |             |  (3) use of attacker-controlled value 's.b' as
divisor without checking for zero
    |      |             (2) ...to here
    |

despite the check for zero at line 13.

https://godbolt.org/z/KK4K8h9z3

Reduced from false positive seen on Linux kernel in drivers/tty/vt/vt_ioctl.c:
(function vt_resizex).

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-07-27 22:08 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-07-07 14:05 [Bug analyzer/106225] New: False positives from -Wanalyzer-tainted-divisor dmalcolm at gcc dot gnu.org
2022-07-07 15:48 ` [Bug analyzer/106225] " dmalcolm at gcc dot gnu.org
2022-07-07 19:56 ` cvs-commit at gcc dot gnu.org
2022-07-07 20:08 ` dmalcolm at gcc dot gnu.org
2022-07-27 21:56 ` cvs-commit at gcc dot gnu.org
2022-07-27 22:08 ` dmalcolm at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).