[Bug analyzer/110014] New: -Wanalyzer-allocation-size mishandles realloc (..., .... * sizeof (object))

[Bug analyzer/110014] New: -Wanalyzer-allocation-size mishandles realloc (..., .... * sizeof (object))

[eggert at cs dot ucla.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110014

            Bug ID: 110014
           Summary: -Wanalyzer-allocation-size mishandles realloc (...,
                    .... * sizeof (object))
           Product: gcc
           Version: 13.1.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: eggert at cs dot ucla.edu
  Target Milestone: ---

Created attachment 55179
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55179&action=edit
compile with 'gcc -fanalyzer -S' to reproduce the bug

This is a followup to bug 109577, and reports a more serious problem with
-Wanalyzer-allocation-size: it mishandles realloc even when the last argument
is obviously a multiple of the object size.

I discovered this problem when compiling an experimental version of GNU
diffutils.

This is with gcc (GCC) 13.1.1 20230511 (Red Hat 13.1.1-2) x86-64.

Compile the attached program with:

gcc -fanalyzer -S w.i

The output is as follows. All the warnings are incorrect. The last warning is
for a call of the form realloc(p, N * sizeof (long)) even though the result is
used as a long * so the call is obviously well-sized.


w.i: In function ‘slurp’:
w.i:11:14: warning: allocated buffer size is not a multiple of the pointee's
size [CWE-131] [-Wanalyzer-allocation-size]
   11 |     buffer = realloc (buffer, cc);
      |              ^~~~~~~~~~~~~~~~~~~~
  ‘slurp’: events 1-4
    |
    |    9 |   if (!__builtin_add_overflow (file_size - file_size % sizeof
(long),
    |      |      ^
    |      |      |
    |      |      (1) following ‘true’ branch...
    |   10 |                                2 * sizeof (long), &cc))
    |   11 |     buffer = realloc (buffer, cc);
    |      |              ~~~~~~~~~~~~~~~~~~~~
    |      |              |
    |      |              (2) ...to here
    |      |              (3) allocated ‘cc’ bytes here
    |      |              (4) assigned to ‘long int *’ here; ‘sizeof (long
int)’ is ‘8’
    |
w.i: In function ‘slurp1’:
w.i:18:10: warning: allocated buffer size is not a multiple of the pointee's
size [CWE-131] [-Wanalyzer-allocation-size]
   18 |   return realloc (buffer, file_size - file_size % sizeof (long));
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ‘slurp1’: events 1-2
    |
    |   18 |   return realloc (buffer, file_size - file_size % sizeof (long));
    |      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |          |
    |      |          (1) allocated ‘file_size & 18446744073709551608’ bytes
here
    |      |          (2) assigned to ‘long int *’ here; ‘sizeof (long int)’ is
‘8’
    |
w.i: In function ‘slurp2’:
w.i:24:10: warning: allocated buffer size is not a multiple of the pointee's
size [CWE-131] [-Wanalyzer-allocation-size]
   24 |   return realloc (buffer, (file_size / sizeof (long)) * sizeof (long));
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ‘slurp2’: events 1-2
    |
    |   24 |   return realloc (buffer, (file_size / sizeof (long)) * sizeof
(long));
    |      |         
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |          |
    |      |          (1) allocated ‘file_size & 18446744073709551608’ bytes
here
    |      |          (2) assigned to ‘long int *’ here; ‘sizeof (long int)’ is
‘8’
    |

[Bug analyzer/110014] -Wanalyzer-allocation-size mishandles realloc (..., .... * sizeof (object))

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110014

--- Comment #1 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Tim Lange <tlange@gcc.gnu.org>:

https://gcc.gnu.org/g:39adc5eebd61fd276f3f1ef9d7228756a35bd0cb

commit r14-1685-g39adc5eebd61fd276f3f1ef9d7228756a35bd0cb
Author: Tim Lange <mail@tim-lange.me>
Date:   Fri Jun 9 20:08:22 2023 +0200

    testsuite: Add more allocation size tests for conjured svalues [PR110014]

    This patch adds the reproducers reported in PR 110014 as test cases. The
    false positives in those cases are already fixed with PR 109577.

    2023-06-09  Tim Lange  <mail@tim-lange.me>

            PR analyzer/110014

    gcc/testsuite/ChangeLog:

            * gcc.dg/analyzer/realloc-pr110014.c: New tests.

[Bug analyzer/110014] -Wanalyzer-allocation-size mishandles realloc (..., .... * sizeof (object))

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110014

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for fixing this Tim.

Keeping open to track backporting this to the gcc 13 branch.

[Bug analyzer/110014] -Wanalyzer-allocation-size mishandles realloc (..., .... * sizeof (object))

[nightstrike at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110014

nightstrike <nightstrike at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |nightstrike at gmail dot com

--- Comment #3 from nightstrike <nightstrike at gmail dot com> ---
(In reply to David Malcolm from comment #2)
> Thanks for fixing this Tim.
> 
> Keeping open to track backporting this to the gcc 13 branch.

Before this gets backported, the testcase should be fixed.  It uses an
incorrect declaration of realloc, assuming that size_t is long.  The standard
defines realloc as size_t, so the declaration should use __SIZE_TYPE__ instead.
 This works, although you could also just include stdlib.h or use
__builtin_realloc.

[Bug analyzer/110014] [13 Regression] -Wanalyzer-allocation-size mishandles realloc (..., .... * sizeof (object))

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110014

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2024-02-15
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED

[Bug analyzer/110014] [13 Regression] -Wanalyzer-allocation-size mishandles realloc (..., .... * sizeof (object))

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110014

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.3

[Bug analyzer/110014] [13 Regression] -Wanalyzer-allocation-size mishandles realloc (..., .... * sizeof (object))

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110014

--- Comment #4 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by David Malcolm
<dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:e0c52905f666e3d23881f82dbf39466a24f009f4

commit r13-8743-ge0c52905f666e3d23881f82dbf39466a24f009f4
Author: Tim Lange <mail@tim-lange.me>
Date:   Thu May 9 13:09:26 2024 -0400

    testsuite: Add more allocation size tests for conjured svalues [PR110014]

    This patch adds the reproducers reported in PR 110014 as test cases. The
    false positives in those cases are already fixed with PR 109577.

    2023-06-09  Tim Lange  <mail@tim-lange.me>

            PR analyzer/110014

    gcc/testsuite/ChangeLog:

            * gcc.dg/analyzer/realloc-pr110014.c: New tests.

    (cherry picked from commit
r14-1685-g39adc5eebd61fd276f3f1ef9d7228756a35bd0cb)

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/110014] -Wanalyzer-allocation-size mishandles realloc (..., .... * sizeof (object))

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110014

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED
            Summary|[13 Regression]             |-Wanalyzer-allocation-size
                   |-Wanalyzer-allocation-size  |mishandles realloc (...,
                   |mishandles realloc (...,    |.... * sizeof (object))
                   |.... * sizeof (object))     |

--- Comment #5 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed for GCC 13 (for the upcoming GCC 13.3) by the above patch.