public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
From: "gcc.gnu.org at aydos dot de" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/106578] New: spurious -Wuse-after-free=2 after conditional free()
Date: Wed, 10 Aug 2022 14:16:45 +0000 [thread overview]
Message-ID: <bug-106578-4@http.gcc.gnu.org/bugzilla/> (raw)
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106578
Bug ID: 106578
Summary: spurious -Wuse-after-free=2 after conditional free()
Product: gcc
Version: 12.1.1
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: middle-end
Assignee: unassigned at gcc dot gnu.org
Reporter: gcc.gnu.org at aydos dot de
Target Milestone: ---
I am new to GCC's components, so feel free to rename the headers if I
classified the bug wrong.
The following code throws the `use-after-free` error:
```
#include <stdlib.h>
void *buf = NULL;
size_t buf_size = 0;
int main() {
void *tmp = buf;
buf = realloc(tmp, 10);
// Realloc returns a pointer to the new object, or a null pointer if the
// new object could not be allocated. Free the original pointer
// to avoid memory leak in latter case.
if (!buf)
free(tmp);
}
```
```
$ gcc -Wall -Wuse-after-free=2 main.c
main.c: In function ‘main’:
main.c:15:17: warning: pointer ‘tmp’ may be used after ‘realloc’
[-Wuse-after-free]
15 | free(tmp);
| ^~~~~~~~~
main.c:9:15: note: call to ‘realloc’ here
9 | buf = realloc(tmp, 10);
| ^~~~~~~~~~~~~~~~
```
A workaround is to `realloc` directly `buf` and use `tmp` for the return value
of `realloc`:
```
#include <stdlib.h>
void *buf = NULL;
size_t buf_size = 0;
int main() {
void *tmp = buf;
tmp = realloc(buf, 10);
if (!tmp)
free(buf);
}
```
>From what I saw in other bugs this one may also be related to the meta-bug
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104075.
Can someone confirm this case?
next reply other threads:[~2022-08-10 14:16 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-10 14:16 gcc.gnu.org at aydos dot de [this message]
2022-08-10 14:22 ` [Bug middle-end/106578] " gcc.gnu.org at aydos dot de
2022-08-10 14:46 ` rguenth at gcc dot gnu.org
2022-08-10 16:04 ` [Bug middle-end/106578] spurious -Wuse-after-free=2 after conditional free() when not optimizing gcc.gnu.org at aydos dot de
2022-08-11 9:30 ` gcc.gnu.org at aydos dot de
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-106578-4@http.gcc.gnu.org/bugzilla/ \
--to=gcc-bugzilla@gcc.gnu.org \
--cc=gcc-bugs@gcc.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).