public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
* [Bug analyzer/110830] New: -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p. @ 2023-07-27 12:41 vultkayn at gcc dot gnu.org 2023-07-31 22:40 ` [Bug analyzer/110830] " dmalcolm at gcc dot gnu.org ` (2 more replies) 0 siblings, 3 replies; 4+ messages in thread From: vultkayn at gcc dot gnu.org @ 2023-07-27 12:41 UTC (permalink / raw) To: gcc-bugs https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110830 Bug ID: 110830 Summary: -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p. Product: gcc Version: 14.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: analyzer Assignee: dmalcolm at gcc dot gnu.org Reporter: vultkayn at gcc dot gnu.org Target Milestone: --- state_machine::supercedes_p is called when two diagnostics are emitted for the same statement, without regarding the path that led to this statement. See reproducer on trunk https://godbolt.org/z/GqebW5s5h #include <stdlib.h> extern int ext(); int* foo() { int *p = 0; if (ext() > 5) { p = malloc (sizeof(int)); *p = 0; free (p); return p; } else return malloc(sizeof(int)); } void test() { int *y = foo(); // (*) int x = 4 + *y; free (y); } At statement (*) both -Wanalyzer-use-of-uninitialized-value and -Wanalyzer-use-after-free should be emitted as solving the latter won't impact the former, since they result from two independent branches. But use_after_free::supercedes_p hides the other. In the case of a false positive -Wanalyzer-use-after-free, or simply one ignored by the user, the adjacent -Wanalyzer-use-of-uninitialized-value would therefore never be emitted. ^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug analyzer/110830] -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p. 2023-07-27 12:41 [Bug analyzer/110830] New: -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p vultkayn at gcc dot gnu.org @ 2023-07-31 22:40 ` dmalcolm at gcc dot gnu.org 2023-07-31 22:43 ` dmalcolm at gcc dot gnu.org 2023-09-07 21:02 ` cvs-commit at gcc dot gnu.org 2 siblings, 0 replies; 4+ messages in thread From: dmalcolm at gcc dot gnu.org @ 2023-07-31 22:40 UTC (permalink / raw) To: gcc-bugs https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110830 --- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> --- For reference, I implemented use_after_free::supercedes_p in commit g:33255ad3ac14e3953750fe0f2d82b901c2852ff6 as part of the gcc 12 (re)implementation of -Wanalyzer-use-of-uninitialized-value. ^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug analyzer/110830] -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p. 2023-07-27 12:41 [Bug analyzer/110830] New: -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p vultkayn at gcc dot gnu.org 2023-07-31 22:40 ` [Bug analyzer/110830] " dmalcolm at gcc dot gnu.org @ 2023-07-31 22:43 ` dmalcolm at gcc dot gnu.org 2023-09-07 21:02 ` cvs-commit at gcc dot gnu.org 2 siblings, 0 replies; 4+ messages in thread From: dmalcolm at gcc dot gnu.org @ 2023-07-31 22:43 UTC (permalink / raw) To: gcc-bugs https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110830 --- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> --- The "supercedes_p" logic is called in diagnostic_manager::emit_saved_diagnostics here: best_candidates.handle_interactions (this); I *think* every saved_diagnostic ought to have a non-NULL m_best_epath by the time this is called. ^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug analyzer/110830] -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p. 2023-07-27 12:41 [Bug analyzer/110830] New: -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p vultkayn at gcc dot gnu.org 2023-07-31 22:40 ` [Bug analyzer/110830] " dmalcolm at gcc dot gnu.org 2023-07-31 22:43 ` dmalcolm at gcc dot gnu.org @ 2023-09-07 21:02 ` cvs-commit at gcc dot gnu.org 2 siblings, 0 replies; 4+ messages in thread From: cvs-commit at gcc dot gnu.org @ 2023-09-07 21:02 UTC (permalink / raw) To: gcc-bugs https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110830 --- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> --- The trunk branch has been updated by Benjamin Priour <vultkayn@gcc.gnu.org>: https://gcc.gnu.org/g:7d2274b9e346f44f8f6598b9dbb9fa95259274a2 commit r14-3794-g7d2274b9e346f44f8f6598b9dbb9fa95259274a2 Author: benjamin priour <vultkayn@gcc.gnu.org> Date: Fri Sep 1 20:21:41 2023 +0200 analyzer: Call off a superseding when diagnostics are unrelated [PR110830] Before this patch, a saved_diagnostic would supersede another at the same statement if and only its vfunc supercedes_p returned true for the other diagnostic's kind. That both warning were unrelated - i.e. resolving one would not fix the other - was not considered in making the above choice. This patch makes it so that two saved_diagnostics taking a different outcome of at least one common conditional branching cannot supersede each other. Signed-off-by: Benjamin Priour <vultkayn@gcc.gnu.org> Co-authored-by: David Malcolm <dmalcolm@redhat.com> Signed-off-by: David Malcolm <dmalcolm@redhat.com> gcc/analyzer/ChangeLog: PR analyzer/110830 * diagnostic-manager.cc (compatible_epaths_p): New function. (saved_diagnostic::supercedes_p): Now calls the above to determine if the diagnostics do overlap and the superseding may proceed. gcc/testsuite/ChangeLog: PR analyzer/110830 * c-c++-common/analyzer/pr110830.c: New test. ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-09-07 21:02 UTC | newest] Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2023-07-27 12:41 [Bug analyzer/110830] New: -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p vultkayn at gcc dot gnu.org 2023-07-31 22:40 ` [Bug analyzer/110830] " dmalcolm at gcc dot gnu.org 2023-07-31 22:43 ` dmalcolm at gcc dot gnu.org 2023-09-07 21:02 ` cvs-commit at gcc dot gnu.org
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).