[Bug sanitizer/107431] New: UBSan has inconsistent behaviors in certain code snippet

[Bug sanitizer/107431] New: UBSan has inconsistent behaviors in certain code snippet

[shaohua.li at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107431

            Bug ID: 107431
           Summary: UBSan has inconsistent behaviors in certain code
                    snippet
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: shaohua.li at inf dot ethz.ch
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org, marxin at gcc dot gnu.org
  Target Milestone: ---

Hi, for the following code, there is a misaligned load at line 5 `long d = *c`.
UBSan detected it successfully. However, if you change the definition of `a`
from `long a` to `int a`, UBSan would report nothing.

% cat example1.c
int main() {
    long a=2;
    int b=1;
    long *c = &b;
    long d = *c;
    &a;
}
% gcc -O0 -fsanitize=undefined example1.c && ./a.out
example1.c:5:10: runtime error: load of misaligned address 0x7fffd97a993c for
type 'long int', which requires 8 byte alignment
0x7fffd97a993c: note: pointer points here
  f0 71 77 cc 01 00 00 00  02 00 00 00 00 00 00 00  3c 99 7a d9 ff 7f 00 00  50
9a 7a d9 ff 7f 00 00
%
% cat example2.c
int main() {
    int a=2;
    int b=1;
    long *c = &b;
    long d = *c;
    &a;
}
% gcc -O0 -fsanitize=undefined example1.c && ./a.out
%

Compiler explorer: https://godbolt.org/z/4oKaMjbee

[Bug sanitizer/107431] UBSan has inconsistent behaviors in certain code snippet

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107431

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
> % cat example2.c
> int main() {
>     int a=2;
>     int b=1;
>     long *c = &b;
>     long d = *c;
>     &a;
> }

Well, in this case you are lucky and 'b' is aligned to 8-bytes:
    __builtin_printf ("&b=%p\n", &b);

$ gcc-12 example2.c -fsanitize=undefined -w && ./a.out
&b=0x7fffffffd438

$ gcc-12 -O1 example2.c -fsanitize=undefined -w && ./a.out
&b=0x7fffffffd44c
example2.c:6:10: runtime error: load of misaligned address 0x7fffffffd44c for
type 'long int', which requires 8 byte alignment
0x7fffffffd44c: note: pointer points here
  67 6c 69 62 01 00 00 00  68 d5 ff ff ff 7f 00 00  b0 c5 62 f7 ff 7f 00 00  50
d5 ff ff ff 7f 00 00
              ^ 
example2.c:6:10: runtime error: load of address 0x7fffffffd44c with
insufficient space for an object of type 'int'
0x7fffffffd44c: note: pointer points here
  67 6c 69 62 01 00 00 00  68 d5 ff ff ff 7f 00 00  b0 c5 62 f7 ff 7f 00 00  50
d5 ff ff ff 7f 00 00
              ^ 

So nothing we can do about it.

[Bug sanitizer/107431] UBSan has inconsistent behaviors in certain code snippet

[shaohua.li at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107431

--- Comment #2 from Li Shaohua <shaohua.li at inf dot ethz.ch> ---
Thanks a lot for the prompt reply!