public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug sanitizer/108894] New: -fsanitize=bounds missing bounds provided by __builtin_dynamic_object_size()
@ 2023-02-22 20:57 kees at outflux dot net
  2023-02-22 21:03 ` [Bug sanitizer/108894] " kees at outflux dot net
                   ` (16 more replies)
  0 siblings, 17 replies; 18+ messages in thread
From: kees at outflux dot net @ 2023-02-22 20:57 UTC (permalink / raw)
  To: gcc-bugs

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108894

            Bug ID: 108894
           Summary: -fsanitize=bounds missing bounds provided by
                    __builtin_dynamic_object_size()
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: kees at outflux dot net
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org, marxin at gcc dot gnu.org
  Target Milestone: ---

Created attachment 54508
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54508&action=edit
PoC showing lack of __bdos support in -fsanitize=bounds

While -fsanitize-bounds is able to perform run-time bounds checking on
fixed-size arrays (i.e. when __builtin_object_size(x, 1) does not return
SIZE_MAX), it does not perform bounds checking when
__builtin_dynamic_object_size(x, 1) is available.

For example, the attached program produces _no_ bounds-checker warnings:

$ gcc -Wall -O2 -fstrict-flex-arrays=3 -fsanitize=bounds -fstrict-flex-arrays=3
-o bounds bounds.c
$ ./bounds

p->array has a fixed size: 64 (16 elements of size 4)
p->array[0] assignment: 255 (should be ok)
p->array[16] assignment: 255 (should be failure)

p->array has a dynamic size: 64 (16 elements of size 4)
p->array[0] assignment: 255 (should be ok)
p->array[16] assignment: 255 (should be failure)

p->array has unknowable size
p->array[0] assignment: 255 (should be ok)
p->array[16] assignment: 255 (should be failure)


Note that the first failure for a fixed size array implies that
-fsanitize=bounds has also not been wired up to -fstrict-flex-arrays=3, so it
is ignoring all trailing arrays.

^ permalink raw reply	[flat|nested] 18+ messages in thread
end of thread, other threads:[~2023-03-01  9:51 UTC | newest]

Thread overview: 18+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-02-22 20:57 [Bug sanitizer/108894] New: -fsanitize=bounds missing bounds provided by __builtin_dynamic_object_size() kees at outflux dot net
2023-02-22 21:03 ` [Bug sanitizer/108894] " kees at outflux dot net
2023-02-22 21:05 ` kees at outflux dot net
2023-02-22 21:06 ` pinskia at gcc dot gnu.org
2023-02-22 21:16 ` mpolacek at gcc dot gnu.org
2023-02-22 21:37 ` jakub at gcc dot gnu.org
2023-02-23  8:41 ` rguenth at gcc dot gnu.org
2023-02-23  8:57 ` jakub at gcc dot gnu.org
2023-02-23 14:24 ` mpolacek at gcc dot gnu.org
2023-02-23 19:40 ` qinzhao at gcc dot gnu.org
2023-02-23 19:43 ` jakub at gcc dot gnu.org
2023-02-23 21:10 ` qinzhao at gcc dot gnu.org
2023-02-23 21:13 ` jakub at gcc dot gnu.org
2023-02-23 21:21 ` qinzhao at gcc dot gnu.org
2023-02-27 16:52 ` jakub at gcc dot gnu.org
2023-02-27 20:18 ` qinzhao at gcc dot gnu.org
2023-02-28 10:39 ` cvs-commit at gcc dot gnu.org
2023-03-01  9:51 ` cvs-commit at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).