public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/109191] New: GCC static analyzer does not warning `*b = 1` where `b` is 1.
@ 2023-03-19 10:06 geoffreydgr at icloud dot com
2023-03-20 20:20 ` [Bug analyzer/109191] " dmalcolm at gcc dot gnu.org
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: geoffreydgr at icloud dot com @ 2023-03-19 10:06 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109191
Bug ID: 109191
Summary: GCC static analyzer does not warning `*b = 1` where
`b` is 1.
Product: gcc
Version: 13.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: geoffreydgr at icloud dot com
Target Milestone: ---
There is a false nagetive. GCC static analyzer does not warning `*b = 1` where
`b` is 1.
In the following case, the value of all elements is 0 except for the a[0][0][0]
which is 1. Dereferencing the pointer variable `b` will result in a crash. I
compiled and ran the program with gcc (version: 13.0.0) and it triggered the
following error: Segmentation fault (core dumped), the analyzer did not
generate an NPD warning.
See it live: https://godbolt.org/z/PY1hxfjY5
```c
#include "stdio.h"
void main()
{
int a[3][2][1] = {1};
int *b = (void *)a[0][0][1];
*b = 1;
}
```
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug analyzer/109191] GCC static analyzer does not warning `*b = 1` where `b` is 1.
2023-03-19 10:06 [Bug analyzer/109191] New: GCC static analyzer does not warning `*b = 1` where `b` is 1 geoffreydgr at icloud dot com
@ 2023-03-20 20:20 ` dmalcolm at gcc dot gnu.org
2023-03-20 20:55 ` dmalcolm at gcc dot gnu.org
2024-02-15 17:59 ` dmalcolm at gcc dot gnu.org
2 siblings, 0 replies; 4+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2023-03-20 20:20 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109191
--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
GCC does emit a -Wint-to-pointer-cast warning on this code, for the int to void
* conversion.
Is this reduced from a real-world example, or just synthesized by hand?
I suppose in theory the analyzer could:
(a) figure out that it reads all zeroes from the array and complain about the
null pointer deref, and/or
(b) complain that we're accessing beyond the end of an array
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug analyzer/109191] GCC static analyzer does not warning `*b = 1` where `b` is 1.
2023-03-19 10:06 [Bug analyzer/109191] New: GCC static analyzer does not warning `*b = 1` where `b` is 1 geoffreydgr at icloud dot com
2023-03-20 20:20 ` [Bug analyzer/109191] " dmalcolm at gcc dot gnu.org
@ 2023-03-20 20:55 ` dmalcolm at gcc dot gnu.org
2024-02-15 17:59 ` dmalcolm at gcc dot gnu.org
2 siblings, 0 replies; 4+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2023-03-20 20:55 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109191
--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
It is valid in the embedded space to do things like
*(SOME_CONSTANT_ADDRESS) = SOME_VALUE;
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug analyzer/109191] GCC static analyzer does not warning `*b = 1` where `b` is 1.
2023-03-19 10:06 [Bug analyzer/109191] New: GCC static analyzer does not warning `*b = 1` where `b` is 1 geoffreydgr at icloud dot com
2023-03-20 20:20 ` [Bug analyzer/109191] " dmalcolm at gcc dot gnu.org
2023-03-20 20:55 ` dmalcolm at gcc dot gnu.org
@ 2024-02-15 17:59 ` dmalcolm at gcc dot gnu.org
2 siblings, 0 replies; 4+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2024-02-15 17:59 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109191
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |INVALID
--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Resolving as "INVALID"; feel free to reopen if there's a response to the above
questions.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-02-15 17:59 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-03-19 10:06 [Bug analyzer/109191] New: GCC static analyzer does not warning `*b = 1` where `b` is 1 geoffreydgr at icloud dot com
2023-03-20 20:20 ` [Bug analyzer/109191] " dmalcolm at gcc dot gnu.org
2023-03-20 20:55 ` dmalcolm at gcc dot gnu.org
2024-02-15 17:59 ` dmalcolm at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).