public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug middle-end/106427] New: -Wuse-after-free=3 false alarm about int (not pointer) variable
@ 2022-07-24 19:52 eggert at cs dot ucla.edu
2022-08-27 7:17 ` [Bug middle-end/106427] " simon at josefsson dot org
0 siblings, 1 reply; 2+ messages in thread
From: eggert at cs dot ucla.edu @ 2022-07-24 19:52 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106427
Bug ID: 106427
Summary: -Wuse-after-free=3 false alarm about int (not pointer)
variable
Product: gcc
Version: 12.1.1
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: middle-end
Assignee: unassigned at gcc dot gnu.org
Reporter: eggert at cs dot ucla.edu
Target Milestone: ---
Created attachment 53341
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53341&action=edit
Compile with '-O2 -S -Wuse-after-free=3' to demonstrate the bug
I ran into this problem when building GNU Tar. Compile the attached program u.i
with "gcc -O2 -S -Wuse-after-free=3 u.i", using GCC 12.1.1 20220507 (Red Hat
12.1.1-1) on x86-64. The output (shown below) is a false alarm, because the
variable 'stop' is of type 'int', and is not a pointer. Apparently GCC is
confused by the assignment statement 'stop = p == end;' and thinks that
accessing 'stop' later implies accessing a freed pointer.
u.i: In function ‘coalesce_segment’:
u.i:6486:18: warning: pointer ‘p’ used after ‘free’ [-Wuse-after-free]
6486 | for (stop = 0; !stop;)
| ^~~~~
In function ‘wsnode_free’,
inlined from ‘coalesce_segment’ at u.i:6499:4:
u.i:6316:3: note: call to ‘free’ here
6316 | free (p);
| ^~~~~~~~
^ permalink raw reply [flat|nested] 2+ messages in thread
* [Bug middle-end/106427] -Wuse-after-free=3 false alarm about int (not pointer) variable
2022-07-24 19:52 [Bug middle-end/106427] New: -Wuse-after-free=3 false alarm about int (not pointer) variable eggert at cs dot ucla.edu
@ 2022-08-27 7:17 ` simon at josefsson dot org
0 siblings, 0 replies; 2+ messages in thread
From: simon at josefsson dot org @ 2022-08-27 7:17 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106427
Simon Josefsson <simon at josefsson dot org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |simon at josefsson dot org
--- Comment #1 from Simon Josefsson <simon at josefsson dot org> ---
I ran into this problem too, here is a simple reproducer:
$ gcc -Werror -Wuse-after-free=3 -g -O2 -o foo foo.c
foo.c: In function 'main':
foo.c:18:6: error: pointer may be used after 'free' [-Werror=use-after-free]
18 | if (strstr (in, "FOO"))
| ^
foo.c:21:3: note: call to 'free' here
21 | free (in);
| ^~~~~~~~~
cc1: all warnings being treated as errors
#include <string.h>
#include <stdlib.h>
extern int readln (char **out);
int
main (void)
{
char *in = NULL;
int i = 0;
if (!readln (&in))
return 0;
if (in == NULL)
return 0;
if (strstr (in, "FOO"))
i = 1;
free (in);
in = NULL;
if (!readln (&in))
return 0;
if (in == NULL)
return 0;
free (in);
return i;
}
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-08-27 7:17 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-07-24 19:52 [Bug middle-end/106427] New: -Wuse-after-free=3 false alarm about int (not pointer) variable eggert at cs dot ucla.edu
2022-08-27 7:17 ` [Bug middle-end/106427] " simon at josefsson dot org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).