From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 3E8623858000; Fri,  4 Aug 2023 20:20:03 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 3E8623858000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1691180403;
	bh=zZeo17rCcvR6cuCvp1NeJKjYdV8LnuKlBIda5C24fvQ=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=pq8RaTV9E5FlBwOTlg3pGSYzHXcwudUIToABU6E7wDKdf4EbfjswCkIuEyvNW4D1L
	 HlN8FqMzHD/lbbwzmE1KNRgQkgfPnJUIypCZuufjljPQatYa3NIbwsSuGz0dIV3twU
	 /d7vEthrShMaA1/2MJC2Vt4G7XeznOKkfT13eJ4A=
From: "cvs-commit at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug analyzer/110426] Missing buffer overflow warning with function
 pointer that has the alloc_size attribute
Date: Fri, 04 Aug 2023 20:20:02 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: analyzer
X-Bugzilla-Version: 13.1.1
X-Bugzilla-Keywords: diagnostic
X-Bugzilla-Severity: normal
X-Bugzilla-Who: cvs-commit at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: dmalcolm at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-110426-4-2SaN9SMCBt@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-110426-4@http.gcc.gnu.org/bugzilla/>
References: <bug-110426-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D110426

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:021077b94741c9300dfff3a24e95b3ffa3f508a7

commit r14-3001-g021077b94741c9300dfff3a24e95b3ffa3f508a7
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Fri Aug 4 16:18:40 2023 -0400

    analyzer: handle function attribute "alloc_size" [PR110426]

    This patch makes -fanalyzer make use of the function attribute
    "alloc_size", allowing -fanalyzer to emit -Wanalyzer-allocation-size,
    -Wanalyzer-out-of-bounds, and -Wanalyzer-tainted-allocation-size on
    execution paths involving allocations using such functions.

    gcc/analyzer/ChangeLog:
            PR analyzer/110426
            * bounds-checking.cc (region_model::check_region_bounds): Handle
            symbolic base regions.
            * call-details.cc: Include "stringpool.h" and "attribs.h".
            (call_details::lookup_function_attribute): New function.
            * call-details.h (call_details::lookup_function_attribute): New
            function decl.
            * region-model-manager.cc
            (region_model_manager::maybe_fold_binop): Add reference to
            PR analyzer/110902.
            * region-model-reachability.cc (reachable_regions::handle_sval):
            Add symbolic regions for pointers that are conjured svalues for
            the LHS of a stmt.
            * region-model.cc (region_model::canonicalize): Purge dynamic
            extents for regions that aren't referenced.
            (get_result_size_in_bytes): New function.
            (region_model::on_call_pre): Use get_result_size_in_bytes and
            potentially set the dynamic extents of the region pointed to by
            the return value.
            (region_model::deref_rvalue): Add param "add_nonnull_constraint"
            and use it to conditionalize adding the constraint.
            (pending_diagnostic_subclass::dubious_allocation_size): Add "st=
mt"
            param to both ctors and use it to initialize new "m_stmt" field.
            (pending_diagnostic_subclass::operator=3D=3D): Use m_stmt; don'=
t use
            m_lhs or m_rhs.
            (pending_diagnostic_subclass::m_stmt): New field.
            (region_model::check_region_size): Generalize to any kind of
            pointer svalue by using deref_rvalue rather than checking for
            region_svalue.  Pass stmt to dubious_allocation_size ctor.
            * region-model.h (region_model::deref_rvalue): Add param
            "add_nonnull_constraint".
            * svalue.cc (conjured_svalue::lhs_value_p): New function.
            * svalue.h (conjured_svalue::lhs_value_p): New decl.

    gcc/testsuite/ChangeLog:
            PR analyzer/110426
            * gcc.dg/analyzer/allocation-size-1.c: Update expected message =
to
            reflect consolidation of size and assignment into a single even=
t.
            * gcc.dg/analyzer/allocation-size-2.c: Likewise.
            * gcc.dg/analyzer/allocation-size-3.c: Likewise.
            * gcc.dg/analyzer/allocation-size-4.c: Likewise.
            * gcc.dg/analyzer/allocation-size-multiline-1.c: Likewise.
            * gcc.dg/analyzer/allocation-size-multiline-2.c: Likewise.
            * gcc.dg/analyzer/allocation-size-multiline-3.c: Likewise.
            * gcc.dg/analyzer/attr-alloc_size-1.c: New test.
            * gcc.dg/analyzer/attr-alloc_size-2.c: New test.
            * gcc.dg/analyzer/attr-alloc_size-3.c: New test.
            * gcc.dg/analyzer/explode-4.c: New test.
            * gcc.dg/analyzer/taint-size-1.c: Add test coverage for
            __attribute__ alloc_size.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>=