[Bug c++/109175] New: error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]

[Bug c++/109175] New: error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]

[malat at debian dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109175

            Bug ID: 109175
           Summary: error: 'void* __builtin_memset(void*, int, long
                    unsigned int)' writing 4 or more bytes into a region
                    of size 0 overflows the destination
                    [-Werror=stringop-overflow=]
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: malat at debian dot org
  Target Milestone: ---

A new warning is appearing in the highway compilation logs on aarch64:

[...]
FAILED: CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o 
/usr/lib/gcc-snapshot/bin/g++ -DHWY_SHARED_DEFINE -I"/<<PKGBUILDDIR>>" -g -O2
-ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -Wformat
-Werror=format-security -DHWY_BROKEN_EMU128=0 -Wdate-time -D_FORTIFY_SOURCE=2
-fPIE -fvisibility=hidden -fvisibility-inlines-hidden
-Wno-builtin-macro-redefined -D__DATE__=\"redacted\"
-D__TIMESTAMP__=\"redacted\" -D__TIME__=\"redacted\" -fmerge-all-constants
-Wall -Wextra -Wconversion -Wsign-conversion -Wvla -Wnon-virtual-dtor
-fmath-errno -fno-exceptions -Werror -DHWY_IS_TEST=1 -DGTEST_HAS_PTHREAD=1 -MD
-MT CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o -MF
CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o.d -o
CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o -c
'/<<PKGBUILDDIR>>/hwy/tests/convert_test.cc'
In file included from /<<PKGBUILDDIR>>/hwy/foreach_target.h:114,
                 from /<<PKGBUILDDIR>>/hwy/tests/convert_test.cc:26:
In function 'hwy::AlignedFreeUniquePtr<float []> hwy::N_SVE2::F16TestCases(D,
size_t&) [with D = Simd<float, 64, 0>]',
    inlined from 'void hwy::N_SVE2::TestF16::operator()(TF32, DF32) [with TF32
= float; DF32 = hwy::N_SVE2::Simd<float, 64, 0>]' at
/<<PKGBUILDDIR>>/hwy/tests/convert_test.cc:300:10:
/<<PKGBUILDDIR>>/hwy/tests/convert_test.cc:288:11: error: 'void*
__builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a
region of size 0 overflows the destination [-Werror=stringop-overflow=]
  288 |     in[i] = 0.0f;
In function 'void hwy::N_SVE2::TestF16::operator()(TF32, DF32) [with TF32 =
float; DF32 = hwy::N_SVE2::Simd<float, 64, 0>]':
cc1plus: note: destination object is likely at address zero
In file included from /<<PKGBUILDDIR>>/hwy/foreach_target.h:103:
In function 'hwy::AlignedFreeUniquePtr<float []> hwy::N_SVE::F16TestCases(D,
size_t&) [with D = Simd<float, 64, 0>]',
    inlined from 'void hwy::N_SVE::TestF16::operator()(TF32, DF32) [with TF32 =
float; DF32 = hwy::N_SVE::Simd<float, 64, 0>]' at
/<<PKGBUILDDIR>>/hwy/tests/convert_test.cc:300:10:
/<<PKGBUILDDIR>>/hwy/tests/convert_test.cc:288:11: error: 'void*
__builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a
region of size 0 overflows the destination [-Werror=stringop-overflow=]
  288 |     in[i] = 0.0f;
In function 'void hwy::N_SVE::TestF16::operator()(TF32, DF32) [with TF32 =
float; DF32 = hwy::N_SVE::Simd<float, 64, 0>]':
cc1plus: note: destination object is likely at address zero
cc1plus: all warnings being treated as errors
[...]

ref:
*
https://buildd.debian.org/status/fetch.php?pkg=highway&arch=arm64&ver=1.0.4%7Egit20230308.a1d7764-1&stamp=1679052435&raw=0

[Bug c++/109175] error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]

[malat at debian dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109175

--- Comment #1 from Mathieu Malaterre <malat at debian dot org> ---
Created attachment 54694
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54694&action=edit
Preprocessed source gcc-13

% /usr/lib/gcc-snapshot/bin/g++  -save-temps=obj -DHWY_SHARED_DEFINE
-I"/home/malat/highway-1.0.4~git20230308.a1d7764" -g -O2
-ffile-prefix-map=/home/malat/highway-1.0.4~git20230308.a1d7764=.
-fstack-protector-strong -Wformat -Werror=format-security -DHWY_BROKEN_EMU128=0
-Wdate-time -D_FORTIFY_SOURCE=2 -fPIE -fvisibility=hidden
-fvisibility-inlines-hidden -Wno-builtin-macro-redefined
-D__DATE__=\"redacted\" -D__TIMESTAMP__=\"redacted\" -D__TIME__=\"redacted\"
-fmerge-all-constants -Wall -Wextra -Wconversion -Wsign-conversion -Wvla
-Wnon-virtual-dtor -fmath-errno -fno-exceptions -Werror -DHWY_IS_TEST=1
-DGTEST_HAS_PTHREAD=1 -MD -MT
CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o -MF
CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o.d -o
CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o -c
'/home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc'

[Bug c++/109175] error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]

[malat at debian dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109175

--- Comment #2 from Mathieu Malaterre <malat at debian dot org> ---
Created attachment 54695
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54695&action=edit
Preprocessed source gcc-12

g++  -save-temps=obj -DHWY_SHARED_DEFINE
-I"/home/malat/highway-1.0.4~git20230308.a1d7764" -g -O2
-ffile-prefix-map=/home/malat/highway-1.0.4~git20230308.a1d7764=.
-fstack-protector-strong -Wformat -Werror=format-security -DHWY_BROKEN_EMU128=0
-Wdate-time -D_FORTIFY_SOURCE=2 -fPIE -fvisibility=hidden
-fvisibility-inlines-hidden -Wno-builtin-macro-redefined
-D__DATE__=\"redacted\" -D__TIMESTAMP__=\"redacted\" -D__TIME__=\"redacted\"
-fmerge-all-constants -Wall -Wextra -Wconversion -Wsign-conversion -Wvla
-Wnon-virtual-dtor -fmath-errno -fno-exceptions -Werror -DHWY_IS_TEST=1
-DGTEST_HAS_PTHREAD=1 -MD -MT
CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o -MF
CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o.d -o
CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o -c
'/home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc'

[Bug c++/109175] error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]

[malat at debian dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109175

--- Comment #3 from Mathieu Malaterre <malat at debian dot org> ---
Compiling the preprocessed source:

% /usr/lib/gcc-snapshot/bin/g++ --verbose -g  -fstack-protector-strong -Wformat
-Werror=format-security -DHWY_BROKEN_EMU128=0 -Wdate-time -D_FORTIFY_SOURCE=2
-fPIE -fvisibility=hidden -fvisibility-inlines-hid
den -Wno-builtin-macro-redefined -fmerge-all-constants -Wall -Wextra
-Wconversion -Wsign-conversion -Wvla -Wnon-virtual-dtor -fmath-errno
-fno-exceptions -Werror -DHWY_IS_TEST=1 -O2 -c 13/convert_test.cc.ii
Using built-in specs.
COLLECT_GCC=/usr/lib/gcc-snapshot/bin/g++
Target: aarch64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 20230315-1'
--with-bugurl=file:///usr/share/doc/gcc-snapshot/README.Bugs
--enable-languages=c,ada,c++,go,d,fortran,objc,obj-c++,m2,rust
--prefix=/usr/lib/gcc-snapshot --with-gcc-major-version-only --program-prefix=
--enable-shared --enable-linker-build-id --disable-nls --enable-bootstrap
--enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes
--with-default-libstdcxx-abi=new --enable-gnu-unique-object
--disable-libquadmath --disable-libquadmath-support --enable-plugin
--with-system-zlib --enable-libphobos-checking=release
--with-target-system-zlib=auto --enable-objc-gc=auto --enable-multiarch
--enable-fix-cortex-a53-843419 --disable-werror --enable-checking=yes,extra,rtl
--build=aarch64-linux-gnu --host=aarch64-linux-gnu --target=aarch64-linux-gnu
--with-build-config=bootstrap-lto-lean --enable-link-serialization=2
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 13.0.1 20230315 (experimental) [master r13-6680-ga9ae16db8cb]
(Debian 20230315-1)
COLLECT_GCC_OPTIONS='-v' '-g' '-fstack-protector-strong' '-Wformat=1'
'-Werror=format-security' '-D' 'HWY_BROKEN_EMU128=0' '-Wdate-time' '-D'
'_FORTIFY_SOURCE=2' '-fPIE' '-fvisibility=hidden' '-fvisibility-inlines-hidden'
'-Wno-builtin-macro-redefined' '-fmerge-all-constants' '-Wall' '-Wextra'
'-Wconversion' '-Wsign-conversion' '-Wvla' '-Wnon-virtual-dtor' '-fmath-errno'
'-fno-exceptions' '-Werror' '-D' 'HWY_IS_TEST=1' '-O2' '-c' '-shared-libgcc'
'-mlittle-endian' '-mabi=lp64'
 /usr/lib/gcc-snapshot/libexec/gcc/aarch64-linux-gnu/13/cc1plus -fpreprocessed
13/convert_test.cc.ii -quiet -dumpbase convert_test.cc.ii -dumpbase-ext .ii
-mlittle-endian -mabi=lp64 -g -O2 -Wformat=1 -Werror=format-security
-Wdate-time -Wno-builtin-macro-redefined -Wall -Wextra -Wconversion
-Wsign-conversion -Wvla -Wnon-virtual-dtor -Werror -version
-fstack-protector-strong -fPIE -fvisibility=hidden -fvisibility-inlines-hidden
-fmerge-all-constants -fmath-errno -fno-exceptions -o /tmp/ccjFMyE5.s
GNU C++17 (Debian 20230315-1) version 13.0.1 20230315 (experimental) [master
r13-6680-ga9ae16db8cb] (aarch64-linux-gnu)
        compiled by GNU C version 13.0.1 20230315 (experimental) [master
r13-6680-ga9ae16db8cb], GMP version 6.2.1, MPFR version 4.2.0, MPC version
1.3.1, isl version isl-0.25-GMP

GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
Compiler executable checksum: 4bc54a683351612d262139a66d85dce2
In file included from
/home/malat/highway-1.0.4~git20230308.a1d7764/hwy/foreach_target.h:114,
                 from
/home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc:26:
In function 'hwy::AlignedFreeUniquePtr<float []> hwy::N_SVE2::F16TestCases(D,
size_t&) [with D = Simd<float, 64, 0>]',
    inlined from 'void hwy::N_SVE2::TestF16::operator()(TF32, DF32) [with TF32
= float; DF32 = hwy::N_SVE2::Simd<float, 64, 0>]' at
/home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc:300:10:
/home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc:288:11:
error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or
more bytes into a region of size 0 overflows the destination
[-Werror=stringop-overflow=]
  288 |     in[i] = 0.0f;
In function 'void hwy::N_SVE2::TestF16::operator()(TF32, DF32) [with TF32 =
float; DF32 = hwy::N_SVE2::Simd<float, 64, 0>]':
cc1plus: note: destination object is likely at address zero
In file included from
/home/malat/highway-1.0.4~git20230308.a1d7764/hwy/foreach_target.h:103:
In function 'hwy::AlignedFreeUniquePtr<float []> hwy::N_SVE::F16TestCases(D,
size_t&) [with D = Simd<float, 64, 0>]',
    inlined from 'void hwy::N_SVE::TestF16::operator()(TF32, DF32) [with TF32 =
float; DF32 = hwy::N_SVE::Simd<float, 64, 0>]' at
/home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc:300:10:
/home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc:288:11:
error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or
more bytes into a region of size 0 overflows the destination
[-Werror=stringop-overflow=]
  288 |     in[i] = 0.0f;
In function 'void hwy::N_SVE::TestF16::operator()(TF32, DF32) [with TF32 =
float; DF32 = hwy::N_SVE::Simd<float, 64, 0>]':
cc1plus: note: destination object is likely at address zero

[Bug tree-optimization/109175] error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109175

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---

  auto in = AllocateAligned<float>(padded);


The pointer returned here could be a nullptr ....

The warning is due to jump threading though.

AllocateAligned calls AllocateAlignedItems

Which could return nullptr:
  if (check != items) {
    return nullptr;
  }

That is checking to make sure there was no wrap around for items*size really.

[Bug tree-optimization/109175] error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]

[malat at debian dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109175

--- Comment #5 from Mathieu Malaterre <malat at debian dot org> ---
c-reduce(d) ugly version:

% cat demo3.cc
struct d {
  using b = float &;
};
template <typename> using c = d::b;
struct e {
  using b = c<float>;
};
template <long, typename> struct j;
template <long f, typename g> using h = typename j<f, g>::b;
template <long, typename...> struct p;
template <typename k, typename... l> struct p<0, k, l...> { using b = k; };
template <typename...> class m;
template <typename n> struct aa {
  aa(n t) : o(t) {}
  static n ab(aa t) { return t.o; }
  n o;
};
template <long, typename...> struct q;
template <long r, typename n, typename... s>
struct q<r, n, s...> : q<1, s...>, aa<n> {
  q(n t, s... ac) : q<1, s...>(ac...), aa<n>(t) {}
};
template <long r, typename n> struct q<r, n> : aa<n> {
  q(n t) : aa<n>(t) {}
};
template <typename ad, typename ae> class m<ad, ae> : public q<0, ad, ae> {
public:
  m(ad t, ae ac) : q<0, ad, ae>(t, ac) {}
};
template <long f, typename... af> struct j<f, m<af...>> {
  using b = typename p<f, af...>::b;
};
template <long f, typename n, typename... s> n ag(q<f, n, s...> t) {
  return q<f, n>::ab(t);
}
template <int f, typename... ah> h<f, m<ah...>> ai(m<ah...> t) { return ag(t);
}
class u {
  struct aj {
    using b = float *;
  };

public:
  using ak = aj::b;
  u(ak t, int) : al(t, long()) {}
  ak w() { return ai<0>(al); }
  m<ak, int> al;
};
struct x : u {
  using u::u;
};
class y {
  x al;

public:
  using ak = u::ak;
  using am = int;
  template <typename an> y(an t, am ac) : al(t, ac) {}
  e::b operator[](long t) { return z()[t]; }
  ak z() { return al.w(); }
};
void *ao();
template <typename ap> ap *aq(long t) {
  if (t)
    return nullptr;
  return static_cast<ap *>(ao());
}
template <typename> using ar = y;
template <typename ap> ar<ap> as(long t, void *) {
  return ar<ap>(aq<ap>(t), int());
}
template <typename ap> ar<ap> as(long t) { return as<ap>(t, nullptr); }
float v;
void at(long t) {
  long a = sizeof(0), i = 0;
  auto b = as<float>(t);
  for (; i < a; ++i)
    b[i] = v;
  for (; i < t; ++i)
    b[i] = 0.0f;
}

 % /usr/lib/gcc-snapshot/bin/g++ -Wall -O2 -o t.o -c demo3.cc
demo3.cc: In function 'void at(long int)':
demo3.cc:79:10: warning: 'void* __builtin_memset(void*, int, long unsigned
int)' writing 4 or more bytes into a region of size 0 overflows the destination
[-Wstringop-overflow=]
   79 |     b[i] = 0.0f;
cc1plus: note: destination object is likely at address zero

[Bug tree-optimization/109175] error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109175

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Reduced all the way removing all of the classes showing exactly what I thought
it was:
```
void *ao();
float *aq(long t) {
  if (t)
    return nullptr;
  return static_cast<float *>(ao());
}
float v;
void at(long t) {
  long a = sizeof(0), i = 0;
  auto b = aq(t);
  for (; i < a; ++i)
    b[i] = v;
  for (; i < t; ++i)
    b[i] = 0.0f;
}
```

Notice how there is no check for null on aq.

[Bug tree-optimization/109175] error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]

[jan.wassenberg at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109175

--- Comment #7 from Jan Wassenberg <jan.wassenberg at gmail dot com> ---
Thanks, I will be changing the code to add a nullptr check.

[Bug tree-optimization/109175] error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]

[malat at debian dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109175

--- Comment #8 from Mathieu Malaterre <malat at debian dot org> ---
(In reply to Andrew Pinski from comment #6)
> Notice how there is no check for null on aq.

Do you want to keep this one open or should we close it as invalid ?