* [Bug c/109789] analyzer-use-of-uninitialized-value false positive
2023-05-09 12:44 [Bug c/109789] New: analyzer-use-of-uninitialized-value false positive alex at zrythm dot org
@ 2023-05-09 12:49 ` alex at zrythm dot org
2023-05-12 3:13 ` [Bug analyzer/109789] " alex at zrythm dot org
` (6 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: alex at zrythm dot org @ 2023-05-09 12:49 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109789
--- Comment #1 from alex at zrythm dot org ---
Created attachment 55029
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55029&action=edit
preprocessed .i file (gzipped)
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug analyzer/109789] analyzer-use-of-uninitialized-value false positive
2023-05-09 12:44 [Bug c/109789] New: analyzer-use-of-uninitialized-value false positive alex at zrythm dot org
2023-05-09 12:49 ` [Bug c/109789] " alex at zrythm dot org
@ 2023-05-12 3:13 ` alex at zrythm dot org
2023-05-12 3:16 ` alex at zrythm dot org
` (5 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: alex at zrythm dot org @ 2023-05-12 3:13 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109789
alex at zrythm dot org changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #55029|0 |1
is obsolete| |
--- Comment #2 from alex at zrythm dot org ---
Created attachment 55060
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55060&action=edit
reduced test case (reduced with cvise)
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug analyzer/109789] analyzer-use-of-uninitialized-value false positive
2023-05-09 12:44 [Bug c/109789] New: analyzer-use-of-uninitialized-value false positive alex at zrythm dot org
2023-05-09 12:49 ` [Bug c/109789] " alex at zrythm dot org
2023-05-12 3:13 ` [Bug analyzer/109789] " alex at zrythm dot org
@ 2023-05-12 3:16 ` alex at zrythm dot org
2023-05-12 3:17 ` alex at zrythm dot org
` (4 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: alex at zrythm dot org @ 2023-05-12 3:16 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109789
alex at zrythm dot org changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #55028|0 |1
is obsolete| |
--- Comment #3 from alex at zrythm dot org ---
Created attachment 55061
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55061&action=edit
gcc invocation output on simplified file
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug analyzer/109789] analyzer-use-of-uninitialized-value false positive
2023-05-09 12:44 [Bug c/109789] New: analyzer-use-of-uninitialized-value false positive alex at zrythm dot org
` (2 preceding siblings ...)
2023-05-12 3:16 ` alex at zrythm dot org
@ 2023-05-12 3:17 ` alex at zrythm dot org
2023-05-12 8:51 ` [Bug analyzer/109789] analyzer-use-of-uninitialized-value false positive inside function when array passed to the function is pre-initialized redi at gcc dot gnu.org
` (3 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: alex at zrythm dot org @ 2023-05-12 3:17 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109789
--- Comment #4 from alex at zrythm dot org ---
I have simplified the test source file using cvise. This can now be reproduced
with:
```
LANG=C gcc -fanalyzer -Werror=analyzer-use-of-uninitialized-value -c
audio_exporter6.c.i
```
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug analyzer/109789] analyzer-use-of-uninitialized-value false positive inside function when array passed to the function is pre-initialized
2023-05-09 12:44 [Bug c/109789] New: analyzer-use-of-uninitialized-value false positive alex at zrythm dot org
` (3 preceding siblings ...)
2023-05-12 3:17 ` alex at zrythm dot org
@ 2023-05-12 8:51 ` redi at gcc dot gnu.org
2023-05-12 9:00 ` redi at gcc dot gnu.org
` (2 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: redi at gcc dot gnu.org @ 2023-05-12 8:51 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109789
Jonathan Wakely <redi at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Last reconfirmed| |2023-05-12
Ever confirmed|0 |1
Status|UNCONFIRMED |NEW
--- Comment #5 from Jonathan Wakely <redi at gcc dot gnu.org> ---
A better reduction:
extern float fabsf(float);
typedef long unsigned size_t;
float dsp_abs_max_ret;
extern float lsp_dsp_abs_max(void);
float dsp_abs_max(float *buf, size_t size) {
for (size_t i = 0; i < size; i++)
if (fabsf(buf[i]) > 1e-20f)
dsp_abs_max_ret = fabsf(buf[i]);
return dsp_abs_max_ret;
}
void export_audio(int nframes, float init, int count) {
do {
float tmp_l[nframes];
for (int i = 0; i < nframes; i++)
tmp_l[i] = init;
float max_amp = dsp_abs_max(tmp_l, nframes);
} while (--count);
}
a.c.i: In function ‘dsp_abs_max’:
a.c.i:11:18: error: use of uninitialized value ‘*buf_16(D) + _1’ [CWE-457]
[-Werror=analyzer-use-of-uninitialized-value]
11 | if (fabsf(buf[i]) > 1e-20f)
| ~~~^~~
‘export_audio’: events 1-5
|
| 15 | void export_audio(int nframes, float init, int count) {
| | ^~~~~~~~~~~~
| | |
| | (1) entry to ‘export_audio’
| 16 | do {
| 17 | float tmp_l[nframes];
| | ~~~~~
| | |
| | (2) region created on stack here
| 18 | for (int i = 0; i < nframes; i++)
| | ~~~~~~~~~~~
| | |
| | (3) following ‘false’ branch (when ‘i >=
nframes’)...
| 19 | tmp_l[i] = init;
| 20 | float max_amp = dsp_abs_max(tmp_l, nframes);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (4) ...to here
| | (5) calling ‘dsp_abs_max’ from ‘export_audio’
|
+--> ‘dsp_abs_max’: events 6-9
|
| 9 | float dsp_abs_max(float *buf, size_t size) {
| | ^~~~~~~~~~~
| | |
| | (6) entry to ‘dsp_abs_max’
| 10 | for (size_t i = 0; i < size; i++)
| | ~~~~~~~~
| | |
| | (7) following ‘true’ branch (when ‘i
< size’)...
| 11 | if (fabsf(buf[i]) > 1e-20f)
| | ~~~~~~
| | |
| | (8) ...to here
| | (9) use of uninitialized value ‘*buf_16(D)
+ _1’ here
|
a.c.i:11:18: error: use of uninitialized value ‘*buf_16(D) + _1’ [CWE-457]
[-Werror=analyzer-use-of-uninitialized-value]
11 | if (fabsf(buf[i]) > 1e-20f)
| ~~~^~~
‘export_audio’: events 1-5
|
| 15 | void export_audio(int nframes, float init, int count) {
| | ^~~~~~~~~~~~
| | |
| | (1) entry to ‘export_audio’
| 16 | do {
| 17 | float tmp_l[nframes];
| | ~~~~~
| | |
| | (2) region created on stack here
| 18 | for (int i = 0; i < nframes; i++)
| | ~~~~~~~~~~~
| | |
| | (3) following ‘false’ branch (when ‘i >=
nframes’)...
| 19 | tmp_l[i] = init;
| 20 | float max_amp = dsp_abs_max(tmp_l, nframes);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (4) ...to here
| | (5) calling ‘dsp_abs_max’ from ‘export_audio’
|
+--> ‘dsp_abs_max’: events 6-11
|
| 9 | float dsp_abs_max(float *buf, size_t size) {
| | ^~~~~~~~~~~
| | |
| | (6) entry to ‘dsp_abs_max’
| 10 | for (size_t i = 0; i < size; i++)
| | ~~~~~~~~
| | |
| | (7) following ‘true’ branch (when ‘i
< size’)...
| | (9) following ‘true’ branch (when ‘i
< size’)...
| 11 | if (fabsf(buf[i]) > 1e-20f)
| | ~~~~~~
| | |
| | (8) ...to here
| | (10) ...to here
| | (11) use of uninitialized value
‘*buf_16(D) + _1’ here
|
a.c.i:12:34: error: use of uninitialized value ‘*buf_16(D) + _5’ [CWE-457]
[-Werror=analyzer-use-of-uninitialized-value]
12 | dsp_abs_max_ret = fabsf(buf[i]);
| ~~~^~~
‘export_audio’: events 1-5
|
| 15 | void export_audio(int nframes, float init, int count) {
| | ^~~~~~~~~~~~
| | |
| | (1) entry to ‘export_audio’
| 16 | do {
| 17 | float tmp_l[nframes];
| | ~~~~~
| | |
| | (2) region created on stack here
| 18 | for (int i = 0; i < nframes; i++)
| | ~~~~~~~~~~~
| | |
| | (3) following ‘false’ branch (when ‘i >=
nframes’)...
| 19 | tmp_l[i] = init;
| 20 | float max_amp = dsp_abs_max(tmp_l, nframes);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (4) ...to here
| | (5) calling ‘dsp_abs_max’ from ‘export_audio’
|
+--> ‘dsp_abs_max’: events 6-11
|
| 9 | float dsp_abs_max(float *buf, size_t size) {
| | ^~~~~~~~~~~
| | |
| | (6) entry to ‘dsp_abs_max’
| 10 | for (size_t i = 0; i < size; i++)
| | ~~~~~~~~
| | |
| | (7) following ‘true’ branch (when ‘i
< size’)...
| 11 | if (fabsf(buf[i]) > 1e-20f)
| | ~ ~
| | | |
| | | (8) ...to here
| | (9) following ‘true’ branch...
| 12 | dsp_abs_max_ret = fabsf(buf[i]);
| | ~~~~~~
| | |
| | (10) ...to here
| | (11) use of uninitialized
value ‘*buf_16(D) + _5’ here
|
a.c.i:12:34: error: use of uninitialized value ‘*buf_16(D) + _5’ [CWE-457]
[-Werror=analyzer-use-of-uninitialized-value]
12 | dsp_abs_max_ret = fabsf(buf[i]);
| ~~~^~~
‘export_audio’: events 1-5
|
| 15 | void export_audio(int nframes, float init, int count) {
| | ^~~~~~~~~~~~
| | |
| | (1) entry to ‘export_audio’
| 16 | do {
| 17 | float tmp_l[nframes];
| | ~~~~~
| | |
| | (2) region created on stack here
| 18 | for (int i = 0; i < nframes; i++)
| | ~~~~~~~~~~~
| | |
| | (3) following ‘false’ branch (when ‘i >=
nframes’)...
| 19 | tmp_l[i] = init;
| 20 | float max_amp = dsp_abs_max(tmp_l, nframes);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (4) ...to here
| | (5) calling ‘dsp_abs_max’ from ‘export_audio’
|
+--> ‘dsp_abs_max’: events 6-11
|
| 9 | float dsp_abs_max(float *buf, size_t size) {
| | ^~~~~~~~~~~
| | |
| | (6) entry to ‘dsp_abs_max’
| 10 | for (size_t i = 0; i < size; i++)
| | ~~~~~~~~
| | |
| | (7) following ‘true’ branch (when ‘i
< size’)...
| | (9) following ‘true’ branch (when ‘i
< size’)...
| 11 | if (fabsf(buf[i]) > 1e-20f)
| | ~
| | |
| | (8) ...to here
| | (10) ...to here
| 12 | dsp_abs_max_ret = fabsf(buf[i]);
| | ~~~~~~
| | |
| | (11) use of uninitialized
value ‘*buf_16(D) + _5’ here
|
cc1: some warnings being treated as errors
It seems to be related to the use of a VLA for the array.
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug analyzer/109789] analyzer-use-of-uninitialized-value false positive inside function when array passed to the function is pre-initialized
2023-05-09 12:44 [Bug c/109789] New: analyzer-use-of-uninitialized-value false positive alex at zrythm dot org
` (4 preceding siblings ...)
2023-05-12 8:51 ` [Bug analyzer/109789] analyzer-use-of-uninitialized-value false positive inside function when array passed to the function is pre-initialized redi at gcc dot gnu.org
@ 2023-05-12 9:00 ` redi at gcc dot gnu.org
2023-05-12 9:26 ` redi at gcc dot gnu.org
2023-05-12 9:32 ` redi at gcc dot gnu.org
7 siblings, 0 replies; 9+ messages in thread
From: redi at gcc dot gnu.org @ 2023-05-12 9:00 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109789
--- Comment #6 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Jonathan Wakely from comment #5)
> float dsp_abs_max(float *buf, size_t size) {
> for (size_t i = 0; i < size; i++)
> if (fabsf(buf[i]) > 1e-20f)
> dsp_abs_max_ret = fabsf(buf[i]);
> return dsp_abs_max_ret;
> }
> void export_audio(int nframes, float init, int count) {
> do {
> float tmp_l[nframes];
> for (int i = 0; i < nframes; i++)
> tmp_l[i] = init;
> float max_amp = dsp_abs_max(tmp_l, nframes);
I think the problem is that frames is signed int and is converted to size_t
when calling this function. The analyzer is complaining that if nframes is
negative, then you'll get a very large size_t and the loop inside dsp_abs_max
will read more variables than were init'd.
Of course if nframes is negative, the program has undefined behaviour anyway,
C17 6.7.6.2 says "each time it is evaluated
it shall have a value greater than zero".
So I think the analyzer should assume the size is greater than zero, or warn
about *that* possibility, at the point of the array declaration.
If you add this to export_audio() then there's no analyzer warning:
if (nframes < 1)
return;
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug analyzer/109789] analyzer-use-of-uninitialized-value false positive inside function when array passed to the function is pre-initialized
2023-05-09 12:44 [Bug c/109789] New: analyzer-use-of-uninitialized-value false positive alex at zrythm dot org
` (5 preceding siblings ...)
2023-05-12 9:00 ` redi at gcc dot gnu.org
@ 2023-05-12 9:26 ` redi at gcc dot gnu.org
2023-05-12 9:32 ` redi at gcc dot gnu.org
7 siblings, 0 replies; 9+ messages in thread
From: redi at gcc dot gnu.org @ 2023-05-12 9:26 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109789
--- Comment #7 from Jonathan Wakely <redi at gcc dot gnu.org> ---
It also seems to depend on array-to-pointer decay from float[nframes] to float*
across the function boundary, because if the loop using the size_t index is
moved into the same function as the array initialization, the analyzer doesn't
complain.
In any case, the value of size_t size should be assumed to positive.
Further reduced:
void sink(float);
void dsp_abs_max(float *buf, unsigned size) {
sink(buf[size - 1]);
}
void export_audio(int nframes, float init, int count) {
do {
float tmp_l[nframes];
for (int i = 0; i < nframes; i++)
tmp_l[i] = init;
dsp_abs_max(tmp_l, nframes);
} while (--count);
}
$ gcc -fanalyzer -Werror=analyzer-use-of-uninitialized-value -c a.c
a.c: In function ‘dsp_abs_max’:
a.c:4:3: error: use of uninitialized value ‘*buf_7(D) + _3’ [CWE-457]
[-Werror=analyzer-use-of-uninitialized-value]
4 | sink(buf[size - 1]);
| ^~~~~~~~~~~~~~~~~~~
‘export_audio’: events 1-5
|
| 6 | void export_audio(int nframes, float init, int count) {
| | ^~~~~~~~~~~~
| | |
| | (1) entry to ‘export_audio’
| 7 | do {
| 8 | float tmp_l[nframes];
| | ~~~~~
| | |
| | (2) region created on stack here
| 9 | for (int i = 0; i < nframes; i++)
| | ~~~~~~~~~~~
| | |
| | (3) following ‘false’ branch (when ‘i >=
nframes’)...
| 10 | tmp_l[i] = init;
| 11 | dsp_abs_max(tmp_l, nframes);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (4) ...to here
| | (5) calling ‘dsp_abs_max’ from ‘export_audio’
|
+--> ‘dsp_abs_max’: events 6-7
|
| 3 | void dsp_abs_max(float *buf, unsigned size) {
| | ^~~~~~~~~~~
| | |
| | (6) entry to ‘dsp_abs_max’
| 4 | sink(buf[size - 1]);
| | ~~~~~~~~~~~~~~~~~~~
| | |
| | (7) use of uninitialized value ‘*buf_7(D) + _3’ here
|
cc1: some warnings being treated as errors
^ permalink raw reply [flat|nested] 9+ messages in thread* [Bug analyzer/109789] analyzer-use-of-uninitialized-value false positive inside function when array passed to the function is pre-initialized
2023-05-09 12:44 [Bug c/109789] New: analyzer-use-of-uninitialized-value false positive alex at zrythm dot org
` (6 preceding siblings ...)
2023-05-12 9:26 ` redi at gcc dot gnu.org
@ 2023-05-12 9:32 ` redi at gcc dot gnu.org
7 siblings, 0 replies; 9+ messages in thread
From: redi at gcc dot gnu.org @ 2023-05-12 9:32 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109789
--- Comment #8 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Jonathan Wakely from comment #7)
> It also seems to depend on array-to-pointer decay from float[nframes] to
> float* across the function boundary, because if the loop using the size_t
> index is moved into the same function as the array initialization, the
> analyzer doesn't complain.
Ah no, this still complains without a separate function:
void sink(int);
void export_audio(int nframes, int init, int count) {
do {
int tmp_l[nframes];
for (int i = 0; i < nframes; i++)
tmp_l[i] = init;
unsigned size = nframes;
sink(tmp_l[size - 1]);
} while (--count);
}
a.c: In function ‘export_audio’:
a.c:9:5: error: use of uninitialized value ‘*tmp_l[<unknown>]’ [CWE-457]
[-Werror=analyzer-use-of-uninitialized-value]
9 | sink(tmp_l[size - 1]);
| ^~~~~~~~~~~~~~~~~~~~~
‘export_audio’: events 1-4
|
| 5 | int tmp_l[nframes];
| | ^~~~~
| | |
| | (1) region created on stack here
| 6 | for (int i = 0; i < nframes; i++)
| | ~~~~~~~~~~~
| | |
| | (2) following ‘false’ branch (when ‘i >=
nframes’)...
| 7 | tmp_l[i] = init;
| 8 | unsigned size = nframes;
| | ~~~~
| | |
| | (3) ...to here
| 9 | sink(tmp_l[size - 1]);
| | ~~~~~~~~~~~~~~~~~~~~~
| | |
| | (4) use of uninitialized value ‘*tmp_l[<unknown>]’ here
|
cc1: some warnings being treated as errors
^ permalink raw reply [flat|nested] 9+ messages in thread