From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id C81883858C00; Wed, 22 Feb 2023 21:37:03 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org C81883858C00
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1677101823;
	bh=LhkbZAGdsSCstejlv3Mh9KNrG8+s/gbEdFkgsN67vFU=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=dDVQBLwmf8VEFFdUcbw1sW/ac6ZRZlBwwAlSEVLKWvB0Lkb40lHd0EPmD+RPXxN1F
	 6WiC5s5eGvRMkW1ipw8kepBPNY9TIsWcBJW8voeCOM7reunnzkJ9HQoKxGbDH1+H0R
	 NC+kHdrctkgapTC1hA0DL14DlkynqHmLM8gyPfHc=
From: "jakub at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug sanitizer/108894] -fsanitize=bounds missing bounds provided by
 __builtin_dynamic_object_size()
Date: Wed, 22 Feb 2023 21:37:03 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: sanitizer
X-Bugzilla-Version: unknown
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: enhancement
X-Bugzilla-Who: jakub at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-108894-4-mhicGQXUwW@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-108894-4@http.gcc.gnu.org/bugzilla/>
References: <bug-108894-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D108894

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
-fstrict-flex-array=3D option doesn't affect the sanitization, if you want =
strict
sanitization of bounds, you should use -fsanitize=3Dbounds-strict rather th=
an
-fsanitize=3Dbounds.
Furthermore, it is misunderstanding on what either of those sanitizers does,
they check the array index against the array domain.  In the case of flexib=
le
array member, that size is unlimited, not some constant or variable (that w=
ould
be just in case of a VLA).
If you want sanitization against object size, there is -fsanitize=3Dobject-=
size
for it.=