public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
From: "redi at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org> To: gcc-bugs@gcc.gnu.org Subject: [Bug analyzer/107534] New: Analyzer should flag shallow copies of resources Date: Sat, 05 Nov 2022 09:58:01 +0000 [thread overview] Message-ID: <bug-107534-4@http.gcc.gnu.org/bugzilla/> (raw) https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107534 Bug ID: 107534 Summary: Analyzer should flag shallow copies of resources Product: gcc Version: 13.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: analyzer Assignee: dmalcolm at gcc dot gnu.org Reporter: redi at gcc dot gnu.org Blocks: 97110 Target Milestone: --- As shown in PR 94355 comment 11, this code reports a use-after-free (and a spurious leak and spurious null deref): struct S { S() { p = new int(); } ~S() { delete p; } int* p = nullptr; }; int main() { S s; S ss = s; } Ideally the copy construction of 'ss' would flag that we end up with two owners of the heap pointer. The new object should either make a deep copy (allocate a new object as a copy of *s.p) or should clear the source so it's left empty (which would require a move constructor, not just the trivial copy constructor that makes the shallow copy here). In other words, rather than flagging three symptoms, flag the cause. The type manages dynamic resources but doesn't have a user-provided copy or move constructor and so manages them unsafely. Referenced Bugs: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97110 [Bug 97110] [meta-bug] tracker bug for supporting C++ in -fanalyzer
reply other threads:[~2022-11-05 9:58 UTC|newest] Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-107534-4@http.gcc.gnu.org/bugzilla/ \ --to=gcc-bugzilla@gcc.gnu.org \ --cc=gcc-bugs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).