[Bug analyzer/109439] New: RFE: Spurious -Wanalyzer-use-of-uninitialized-value tagging along -Wanalyzer-out-of-bounds

[Bug analyzer/109439] New: RFE: Spurious -Wanalyzer-use-of-uninitialized-value tagging along -Wanalyzer-out-of-bounds

[priour.be at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109439

            Bug ID: 109439
           Summary: RFE: Spurious -Wanalyzer-use-of-uninitialized-value
                    tagging along -Wanalyzer-out-of-bounds
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: priour.be at gmail dot com
                CC: priour.be at gmail dot com
  Target Milestone: ---
             Build: 13.0.1 20230328 (experimental)

For every -Wanalyzer-out-of-bounds, a corresponding
-Wanalyzer-use-of-initialized-value seemingly tags along.
As most likely fixing the former would also fix the latter, it would make sense
to only have a OOB diagnosed.

Tested on trunk.

int would_like_only_oob ()
{
    int arr[] = {1,2,3,4,5,6,7};
    int y1 = arr[9]; // 2 warnings instead of only OOB warning are emitted here
    return y1;
} 

In the mail list, David suggested that

"Maybe we could fix this by having region_model::check_region_bounds
return a bool that signifies if the access is valid, and propagating
that value up through callers so that we can return a non-
poisoned_svalue at the point where we'd normally return an
"uninitialized" poisoned_svalue.

Alternatively, we could simply terminate any analysis path in which an
OOB access is detected (by implementing the
pending_diagnostic::terminate_path_p virtual function for class
out_of_bounds)."

[Bug analyzer/109439] RFE: Spurious -Wanalyzer-use-of-uninitialized-value tagging along -Wanalyzer-out-of-bounds

[vultkayn at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109439

--- Comment #1 from Benjamin Priour <vultkayn at gcc dot gnu.org> ---
*** Bug 109437 has been marked as a duplicate of this bug. ***

[Bug analyzer/109439] RFE: Spurious -Wanalyzer-use-of-uninitialized-value tagging along -Wanalyzer-out-of-bounds

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109439

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The trunk branch has been updated by Benjamin Priour <vultkayn@gcc.gnu.org>:

https://gcc.gnu.org/g:9589a46ddadc8b93c224c3f84fa94746c04596bf

commit r14-1632-g9589a46ddadc8b93c224c3f84fa94746c04596bf
Author: Benjamin Priour <vultkayn@gcc.gnu.org>
Date:   Thu Jun 8 11:38:08 2023 +0200

    analyzer: Standalone OOB-warning [PR109437, PR109439]

    This patch enhances -Wanalyzer-out-of-bounds that is no longer paired
    with a -Wanalyzer-use-of-uninitialized-value on out-of-bounds-read.

    This also fixes PR analyzer/109437.
    Before there could always be at most one OOB-read warning per frame because
    -Wanalyzer-use-of-uninitialized-value always terminates the analysis
    path.

    PR 109439

    gcc/analyzer/ChangeLog:

            * bounds-checking.cc (region_model::check_symbolic_bounds): Returns
whether the BASE_REG
            region access was OOB.
            (region_model::check_region_bounds): Likewise.
            * region-model.cc (region_model::get_store_value): Creates an
            unknown svalue on OOB-read access to REG.
            (region_model::check_region_access): Returns whether an unknown
svalue needs be created.
            (region_model::check_region_for_read): Passes check_region_access
return value.
            * region-model.h: Update prior function definitions.

    gcc/testsuite/ChangeLog:

            * gcc.dg/analyzer/out-of-bounds-2.c: Cleaned test for
uninitialized-value warning
            * gcc.dg/analyzer/out-of-bounds-5.c: Likewise.
            * gcc.dg/analyzer/pr101962.c: Likewise.
            * gcc.dg/analyzer/realloc-5.c: Likewise.
            * gcc.dg/analyzer/pr109439.c: New test.

[Bug analyzer/109439] RFE: Spurious -Wanalyzer-use-of-uninitialized-value tagging along -Wanalyzer-out-of-bounds

[vultkayn at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109439

Benjamin Priour <vultkayn at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from Benjamin Priour <vultkayn at gcc dot gnu.org> ---
Resolved as part of the above patch.