[Bug analyzer/109191] New: GCC static analyzer does not warning `*b = 1` where `b` is 1.

[Bug analyzer/109191] New: GCC static analyzer does not warning `*b = 1` where `b` is 1.

[geoffreydgr at icloud dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109191

            Bug ID: 109191
           Summary: GCC static analyzer does not warning `*b = 1` where
                    `b` is 1.
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: geoffreydgr at icloud dot com
  Target Milestone: ---

There is a false nagetive. GCC static analyzer does not warning `*b = 1` where
`b` is 1. 

In the following case, the value of all elements is 0 except for the a[0][0][0]
which is 1. Dereferencing the pointer variable `b` will result in a crash. I
compiled and ran the program with gcc (version: 13.0.0) and it triggered the
following error: Segmentation fault (core dumped), the analyzer did not
generate an NPD warning.

See it live: https://godbolt.org/z/PY1hxfjY5

```c
#include "stdio.h"
void main()
{
    int a[3][2][1] = {1};
    int *b = (void *)a[0][0][1];
    *b = 1;
}
```

[Bug analyzer/109191] GCC static analyzer does not warning `*b = 1` where `b` is 1.

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109191

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
GCC does emit a -Wint-to-pointer-cast warning on this code, for the int to void
* conversion.

Is this reduced from a real-world example, or just synthesized by hand?

I suppose in theory the analyzer could:

(a) figure out that it reads all zeroes from the array and complain about the
null pointer deref, and/or

(b) complain that we're accessing beyond the end of an array

[Bug analyzer/109191] GCC static analyzer does not warning `*b = 1` where `b` is 1.

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109191

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
It is valid in the embedded space to do things like

   *(SOME_CONSTANT_ADDRESS) = SOME_VALUE;

[Bug analyzer/109191] GCC static analyzer does not warning `*b = 1` where `b` is 1.

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109191

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Resolving as "INVALID"; feel free to reopen if there's a response to the above
questions.