[Bug c/109298] New: warning: array subscript ‘...’ is partly outside array bounds of ‘...’

["ubizjak at gmail dot com" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109298

            Bug ID: 109298
           Summary: warning: array subscript ‘...’ is partly outside array
                    bounds of ‘...’
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: ubizjak at gmail dot com
  Target Milestone: ---

This warning/error is actually emitted when compiling
drivers/infiniband/core/user_mad.c linux source file.

The testcase:

--cut here--
enum {
        IB_MGMT_RMPP_HDR = 36,
        IB_MGMT_RMPP_DATA = 220,
};

struct ib_umad_packet {
        int hdr;
        unsigned char data[];
};

struct ib_rmpp_mad {
        int class;
        unsigned char data[IB_MGMT_RMPP_DATA];
};

int foo (const unsigned char *buf)
{
  struct ib_umad_packet *packet;
  struct ib_rmpp_mad *rmpp_mad;

  packet = __builtin_malloc (sizeof *packet + IB_MGMT_RMPP_HDR);

  __builtin_memcpy (&packet->data, buf, IB_MGMT_RMPP_HDR);

  rmpp_mad = (struct ib_rmpp_mad *) packet->data;

  return rmpp_mad->class;
}
--cut here--

-O2 -Wall

test.c: In function ‘foo’:
test.c:27:18: warning: array subscript ‘struct ib_rmpp_mad[0]’ is partly
outside array bounds of ‘unsigned char[40]’ [-Warray-bounds=]
   27 |   return rmpp_mad->class;
      |                  ^~
test.c:21:12: note: at offset 4 into object of size 40 allocated by
‘__builtin_malloc’
   21 |   packet = __builtin_malloc (sizeof *packet + IB_MGMT_RMPP_HDR);
      |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Adding -fno-strict-aliasing to compile flags does not help.