public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
From: "jhb at FreeBSD dot org" <gcc-bugzilla@gcc.gnu.org> To: gcc-bugs@gcc.gnu.org Subject: [Bug tree-optimization/110501] Invalid use-after-free / realloc with a store/load happening Date: Tue, 31 Oct 2023 16:18:18 +0000 [thread overview] Message-ID: <bug-110501-4-CngB8TSRTg@http.gcc.gnu.org/bugzilla/> (raw) In-Reply-To: <bug-110501-4@http.gcc.gnu.org/bugzilla/> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110501 John Baldwin <jhb at FreeBSD dot org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jhb at FreeBSD dot org --- Comment #7 from John Baldwin <jhb at FreeBSD dot org> --- I believe I am hitting this same issue using GCC 13 to compile FreeBSD's userland. (I looked through several of the other bugs for the Wuse-after-free metabug and this one seems the closest to what I'm encountering). The code in question does not trigger the -Wuse-after-free warning when using GCC 12, but now triggers the warning with GCC 13. It is just calling free on the old value after realloc fails which should be safe. The simplest version I've encountered so far in FreeBSD's tree is this: static int group_resize(void) { char *buf; if (gbufsize == 0) gbufsize = 1024; else gbufsize *= 2; buf = gbuffer; gbuffer = realloc(buf, gbufsize); if (gbuffer == NULL) { free(buf); gbufsize = 0; return (ENOMEM); } memset(gbuffer, 0, gbufsize); return (0); } The warning triggers on the call to free: lib/libcasper/services/cap_grp/cap_grp.c: In function 'group_resize': lib/libcasper/services/cap_grp/cap_grp.c:65:17: error: pointer 'buf' may be used after 'realloc' [-Werror=use-after-free] 65 | free(buf); | ^~~~~~~~~ lib/libcasper/services/cap_grp/cap_grp.c:63:19: note: call to 'realloc' here 63 | gbuffer = realloc(buf, gbufsize); | ^~~~~~~~~~~~~~~~~~~~~~
next prev parent reply other threads:[~2023-10-31 16:18 UTC|newest] Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top 2023-06-30 15:10 [Bug analyzer/110501] New: Invalid use-after-free / realloc cheyenne.wills at gmail dot com 2023-06-30 15:11 ` [Bug analyzer/110501] " cheyenne.wills at gmail dot com 2023-06-30 16:10 ` [Bug tree-optimization/110501] Invalid use-after-free / realloc at -O0 pinskia at gcc dot gnu.org 2023-06-30 16:12 ` [Bug tree-optimization/110501] Invalid use-after-free / realloc with a store/load happening pinskia at gcc dot gnu.org 2023-06-30 16:16 ` cheyenne.wills at gmail dot com 2023-07-03 6:24 ` rguenth at gcc dot gnu.org 2023-07-06 20:49 ` cheyenne.wills at gmail dot com 2023-10-31 16:18 ` jhb at FreeBSD dot org [this message] 2024-03-10 14:03 ` [Bug tree-optimization/110501] [13/14 regression] Invalid -Wuse-after-free " sjames at gcc dot gnu.org 2024-04-04 7:39 ` rguenth at gcc dot gnu.org 2024-04-04 7:39 ` rguenth at gcc dot gnu.org 2024-05-21 9:16 ` [Bug tree-optimization/110501] [13/14/15 " jakub at gcc dot gnu.org
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-110501-4-CngB8TSRTg@http.gcc.gnu.org/bugzilla/ \ --to=gcc-bugzilla@gcc.gnu.org \ --cc=gcc-bugs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).