public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug sanitizer/109151] New: UBsan misses a divide-by-zero
@ 2023-03-15 21:51 shaohua.li at inf dot ethz.ch
2023-03-15 21:54 ` [Bug c/109151] " pinskia at gcc dot gnu.org
` (9 more replies)
0 siblings, 10 replies; 11+ messages in thread
From: shaohua.li at inf dot ethz.ch @ 2023-03-15 21:51 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109151
Bug ID: 109151
Summary: UBsan misses a divide-by-zero
Product: gcc
Version: 13.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: sanitizer
Assignee: unassigned at gcc dot gnu.org
Reporter: shaohua.li at inf dot ethz.ch
CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
jakub at gcc dot gnu.org, kcc at gcc dot gnu.org, marxin at gcc dot gnu.org
Target Milestone: ---
For the following code, UBsan failed to report the divide-by-zero, while
Clang's UBsan could.
Compiler explorer: https://godbolt.org/z/Y73vrf8zK
%cat a.c
int a, c;
short b;
long d;
int main() {
a = (short)(d == c | b > 9) / 0;
return a;
}
%
% gcc -fsanitize=undefined a.c &&./a.out
Floating point exception
%
% clang -fsanitize=undefined a.c &&./a.out
/a.c:5:42: runtime error: division by zero
%
^ permalink raw reply [flat|nested] 11+ messages in thread
* [Bug c/109151] UBsan misses a divide-by-zero
2023-03-15 21:51 [Bug sanitizer/109151] New: UBsan misses a divide-by-zero shaohua.li at inf dot ethz.ch
@ 2023-03-15 21:54 ` pinskia at gcc dot gnu.org
2023-03-15 22:02 ` pinskia at gcc dot gnu.org
` (8 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: pinskia at gcc dot gnu.org @ 2023-03-15 21:54 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109151
Andrew Pinski <pinskia at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Component|sanitizer |c
--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
The C++ front-end can detect it ...
^ permalink raw reply [flat|nested] 11+ messages in thread
* [Bug c/109151] UBsan misses a divide-by-zero
2023-03-15 21:51 [Bug sanitizer/109151] New: UBsan misses a divide-by-zero shaohua.li at inf dot ethz.ch
2023-03-15 21:54 ` [Bug c/109151] " pinskia at gcc dot gnu.org
@ 2023-03-15 22:02 ` pinskia at gcc dot gnu.org
2023-03-16 9:17 ` jakub at gcc dot gnu.org
` (7 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: pinskia at gcc dot gnu.org @ 2023-03-15 22:02 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109151
Andrew Pinski <pinskia at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Known to fail| |4.9.0
Status|UNCONFIRMED |NEW
Last reconfirmed| |2023-03-15
Ever confirmed|0 |1
--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed
Here is the shortest testcase which shows the issue:
int d;
int main() {
return ((short)(d == 1 | d > 9)) / 0;
}
^ permalink raw reply [flat|nested] 11+ messages in thread
* [Bug c/109151] UBsan misses a divide-by-zero
2023-03-15 21:51 [Bug sanitizer/109151] New: UBsan misses a divide-by-zero shaohua.li at inf dot ethz.ch
2023-03-15 21:54 ` [Bug c/109151] " pinskia at gcc dot gnu.org
2023-03-15 22:02 ` pinskia at gcc dot gnu.org
@ 2023-03-16 9:17 ` jakub at gcc dot gnu.org
2023-03-17 15:11 ` cvs-commit at gcc dot gnu.org
` (6 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: jakub at gcc dot gnu.org @ 2023-03-16 9:17 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109151
Jakub Jelinek <jakub at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
Assignee|unassigned at gcc dot gnu.org |jakub at gcc dot gnu.org
--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 54679
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54679&action=edit
gcc13-pr109151.patch
Untested fix.
^ permalink raw reply [flat|nested] 11+ messages in thread
* [Bug c/109151] UBsan misses a divide-by-zero
2023-03-15 21:51 [Bug sanitizer/109151] New: UBsan misses a divide-by-zero shaohua.li at inf dot ethz.ch
` (2 preceding siblings ...)
2023-03-16 9:17 ` jakub at gcc dot gnu.org
@ 2023-03-17 15:11 ` cvs-commit at gcc dot gnu.org
2023-03-19 5:31 ` cvs-commit at gcc dot gnu.org
` (5 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2023-03-17 15:11 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109151
--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:
https://gcc.gnu.org/g:103d423f6ce72ccb03d55b7b1dfa2dabd5854371
commit r13-6738-g103d423f6ce72ccb03d55b7b1dfa2dabd5854371
Author: Jakub Jelinek <jakub@redhat.com>
Date: Fri Mar 17 16:10:14 2023 +0100
c, ubsan: Instrument even shortened divisions [PR109151]
On the following testcase, the C FE decides to shorten the division because
it has a guarantee that INT_MIN / -1 division won't be encountered, the
first operand is widened from narrower unsigned and/or the second operand
is
a constant other than all ones (in this case both are true).
The problem is that the narrower type in this case is _Bool and
ubsan_instrument_division only instruments it if op0's type is INTEGER_TYPE
or REAL_TYPE. Strangely this doesn't happen in C++ FE.
Anyway, we only shorten divisions if the INT_MIN / -1 case is impossible,
so I think we should be fine even with -fstrict-enums in C++ in case it
shortened to ENUMERAL_TYPEs.
The following patch just instruments those on the ubsan_instrument_division
side. Perhaps only the first hunk and testcase might be needed because
we shouldn't shorten if the other case could be triggered.
2023-03-17 Jakub Jelinek <jakub@redhat.com>
PR c/109151
* c-ubsan.cc (ubsan_instrument_division): Handle all scalar
integral
types rather than just INTEGER_TYPE.
* c-c++-common/ubsan/div-by-zero-8.c: New test.
^ permalink raw reply [flat|nested] 11+ messages in thread
* [Bug c/109151] UBsan misses a divide-by-zero
2023-03-15 21:51 [Bug sanitizer/109151] New: UBsan misses a divide-by-zero shaohua.li at inf dot ethz.ch
` (3 preceding siblings ...)
2023-03-17 15:11 ` cvs-commit at gcc dot gnu.org
@ 2023-03-19 5:31 ` cvs-commit at gcc dot gnu.org
2023-03-20 10:29 ` jakub at gcc dot gnu.org
` (4 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2023-03-19 5:31 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109151
--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:
https://gcc.gnu.org/g:ffb22189be90216e6af386aaef8b76d2dcd05b84
commit r12-9292-gffb22189be90216e6af386aaef8b76d2dcd05b84
Author: Jakub Jelinek <jakub@redhat.com>
Date: Fri Mar 17 16:10:14 2023 +0100
c, ubsan: Instrument even shortened divisions [PR109151]
On the following testcase, the C FE decides to shorten the division because
it has a guarantee that INT_MIN / -1 division won't be encountered, the
first operand is widened from narrower unsigned and/or the second operand
is
a constant other than all ones (in this case both are true).
The problem is that the narrower type in this case is _Bool and
ubsan_instrument_division only instruments it if op0's type is INTEGER_TYPE
or REAL_TYPE. Strangely this doesn't happen in C++ FE.
Anyway, we only shorten divisions if the INT_MIN / -1 case is impossible,
so I think we should be fine even with -fstrict-enums in C++ in case it
shortened to ENUMERAL_TYPEs.
The following patch just instruments those on the ubsan_instrument_division
side. Perhaps only the first hunk and testcase might be needed because
we shouldn't shorten if the other case could be triggered.
2023-03-17 Jakub Jelinek <jakub@redhat.com>
PR c/109151
* c-ubsan.cc (ubsan_instrument_division): Handle all scalar
integral
types rather than just INTEGER_TYPE.
* c-c++-common/ubsan/div-by-zero-8.c: New test.
(cherry picked from commit 103d423f6ce72ccb03d55b7b1dfa2dabd5854371)
^ permalink raw reply [flat|nested] 11+ messages in thread
* [Bug c/109151] UBsan misses a divide-by-zero
2023-03-15 21:51 [Bug sanitizer/109151] New: UBsan misses a divide-by-zero shaohua.li at inf dot ethz.ch
` (4 preceding siblings ...)
2023-03-19 5:31 ` cvs-commit at gcc dot gnu.org
@ 2023-03-20 10:29 ` jakub at gcc dot gnu.org
2023-05-02 20:15 ` cvs-commit at gcc dot gnu.org
` (3 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: jakub at gcc dot gnu.org @ 2023-03-20 10:29 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109151
--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 12.3 too.
^ permalink raw reply [flat|nested] 11+ messages in thread
* [Bug c/109151] UBsan misses a divide-by-zero
2023-03-15 21:51 [Bug sanitizer/109151] New: UBsan misses a divide-by-zero shaohua.li at inf dot ethz.ch
` (5 preceding siblings ...)
2023-03-20 10:29 ` jakub at gcc dot gnu.org
@ 2023-05-02 20:15 ` cvs-commit at gcc dot gnu.org
2023-05-03 10:44 ` jakub at gcc dot gnu.org
` (2 subsequent siblings)
9 siblings, 0 replies; 11+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2023-05-02 20:15 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109151
--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:
https://gcc.gnu.org/g:7d9f6140f0fdd59be002a2efb1d61939b29b450f
commit r11-10726-g7d9f6140f0fdd59be002a2efb1d61939b29b450f
Author: Jakub Jelinek <jakub@redhat.com>
Date: Fri Mar 17 16:10:14 2023 +0100
c, ubsan: Instrument even shortened divisions [PR109151]
On the following testcase, the C FE decides to shorten the division because
it has a guarantee that INT_MIN / -1 division won't be encountered, the
first operand is widened from narrower unsigned and/or the second operand
is
a constant other than all ones (in this case both are true).
The problem is that the narrower type in this case is _Bool and
ubsan_instrument_division only instruments it if op0's type is INTEGER_TYPE
or REAL_TYPE. Strangely this doesn't happen in C++ FE.
Anyway, we only shorten divisions if the INT_MIN / -1 case is impossible,
so I think we should be fine even with -fstrict-enums in C++ in case it
shortened to ENUMERAL_TYPEs.
The following patch just instruments those on the ubsan_instrument_division
side. Perhaps only the first hunk and testcase might be needed because
we shouldn't shorten if the other case could be triggered.
2023-03-17 Jakub Jelinek <jakub@redhat.com>
PR c/109151
* c-ubsan.c (ubsan_instrument_division): Handle all scalar integral
types rather than just INTEGER_TYPE.
* c-c++-common/ubsan/div-by-zero-8.c: New test.
(cherry picked from commit 103d423f6ce72ccb03d55b7b1dfa2dabd5854371)
^ permalink raw reply [flat|nested] 11+ messages in thread
* [Bug c/109151] UBsan misses a divide-by-zero
2023-03-15 21:51 [Bug sanitizer/109151] New: UBsan misses a divide-by-zero shaohua.li at inf dot ethz.ch
` (6 preceding siblings ...)
2023-05-02 20:15 ` cvs-commit at gcc dot gnu.org
@ 2023-05-03 10:44 ` jakub at gcc dot gnu.org
2023-05-03 15:22 ` cvs-commit at gcc dot gnu.org
2023-05-04 7:25 ` jakub at gcc dot gnu.org
9 siblings, 0 replies; 11+ messages in thread
From: jakub at gcc dot gnu.org @ 2023-05-03 10:44 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109151
--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 11.4 as well.
^ permalink raw reply [flat|nested] 11+ messages in thread
* [Bug c/109151] UBsan misses a divide-by-zero
2023-03-15 21:51 [Bug sanitizer/109151] New: UBsan misses a divide-by-zero shaohua.li at inf dot ethz.ch
` (7 preceding siblings ...)
2023-05-03 10:44 ` jakub at gcc dot gnu.org
@ 2023-05-03 15:22 ` cvs-commit at gcc dot gnu.org
2023-05-04 7:25 ` jakub at gcc dot gnu.org
9 siblings, 0 replies; 11+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2023-05-03 15:22 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109151
--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:
https://gcc.gnu.org/g:bdd543db33706643993a468740487147c89a4bd2
commit r10-11379-gbdd543db33706643993a468740487147c89a4bd2
Author: Jakub Jelinek <jakub@redhat.com>
Date: Fri Mar 17 16:10:14 2023 +0100
c, ubsan: Instrument even shortened divisions [PR109151]
On the following testcase, the C FE decides to shorten the division because
it has a guarantee that INT_MIN / -1 division won't be encountered, the
first operand is widened from narrower unsigned and/or the second operand
is
a constant other than all ones (in this case both are true).
The problem is that the narrower type in this case is _Bool and
ubsan_instrument_division only instruments it if op0's type is INTEGER_TYPE
or REAL_TYPE. Strangely this doesn't happen in C++ FE.
Anyway, we only shorten divisions if the INT_MIN / -1 case is impossible,
so I think we should be fine even with -fstrict-enums in C++ in case it
shortened to ENUMERAL_TYPEs.
The following patch just instruments those on the ubsan_instrument_division
side. Perhaps only the first hunk and testcase might be needed because
we shouldn't shorten if the other case could be triggered.
2023-03-17 Jakub Jelinek <jakub@redhat.com>
PR c/109151
* c-ubsan.c (ubsan_instrument_division): Handle all scalar integral
types rather than just INTEGER_TYPE.
* c-c++-common/ubsan/div-by-zero-8.c: New test.
(cherry picked from commit 103d423f6ce72ccb03d55b7b1dfa2dabd5854371)
^ permalink raw reply [flat|nested] 11+ messages in thread
* [Bug c/109151] UBsan misses a divide-by-zero
2023-03-15 21:51 [Bug sanitizer/109151] New: UBsan misses a divide-by-zero shaohua.li at inf dot ethz.ch
` (8 preceding siblings ...)
2023-05-03 15:22 ` cvs-commit at gcc dot gnu.org
@ 2023-05-04 7:25 ` jakub at gcc dot gnu.org
9 siblings, 0 replies; 11+ messages in thread
From: jakub at gcc dot gnu.org @ 2023-05-04 7:25 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109151
Jakub Jelinek <jakub at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
Resolution|--- |FIXED
--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 10.5 too.
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2023-05-04 7:25 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-03-15 21:51 [Bug sanitizer/109151] New: UBsan misses a divide-by-zero shaohua.li at inf dot ethz.ch
2023-03-15 21:54 ` [Bug c/109151] " pinskia at gcc dot gnu.org
2023-03-15 22:02 ` pinskia at gcc dot gnu.org
2023-03-16 9:17 ` jakub at gcc dot gnu.org
2023-03-17 15:11 ` cvs-commit at gcc dot gnu.org
2023-03-19 5:31 ` cvs-commit at gcc dot gnu.org
2023-03-20 10:29 ` jakub at gcc dot gnu.org
2023-05-02 20:15 ` cvs-commit at gcc dot gnu.org
2023-05-03 10:44 ` jakub at gcc dot gnu.org
2023-05-03 15:22 ` cvs-commit at gcc dot gnu.org
2023-05-04 7:25 ` jakub at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).