public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/110830] New: -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p.
@ 2023-07-27 12:41 vultkayn at gcc dot gnu.org
2023-07-31 22:40 ` [Bug analyzer/110830] " dmalcolm at gcc dot gnu.org
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: vultkayn at gcc dot gnu.org @ 2023-07-27 12:41 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110830
Bug ID: 110830
Summary: -Wanalyzer-use-of-uninitialized-value false negative
due to use-after-free::supercedes_p.
Product: gcc
Version: 14.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: vultkayn at gcc dot gnu.org
Target Milestone: ---
state_machine::supercedes_p is called when two diagnostics are emitted for the
same statement, without regarding the path that led to this statement.
See reproducer on trunk https://godbolt.org/z/GqebW5s5h
#include <stdlib.h>
extern int ext();
int* foo()
{
int *p = 0;
if (ext() > 5)
{
p = malloc (sizeof(int));
*p = 0;
free (p);
return p;
}
else
return malloc(sizeof(int));
}
void test()
{
int *y = foo(); // (*)
int x = 4 + *y;
free (y);
}
At statement (*) both -Wanalyzer-use-of-uninitialized-value and
-Wanalyzer-use-after-free should be emitted as solving the latter won't impact
the former, since they result from two independent branches. But
use_after_free::supercedes_p hides the other.
In the case of a false positive -Wanalyzer-use-after-free, or simply one
ignored by the user, the adjacent -Wanalyzer-use-of-uninitialized-value would
therefore never be emitted.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug analyzer/110830] -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p.
2023-07-27 12:41 [Bug analyzer/110830] New: -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p vultkayn at gcc dot gnu.org
@ 2023-07-31 22:40 ` dmalcolm at gcc dot gnu.org
2023-07-31 22:43 ` dmalcolm at gcc dot gnu.org
2023-09-07 21:02 ` cvs-commit at gcc dot gnu.org
2 siblings, 0 replies; 4+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2023-07-31 22:40 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110830
--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
For reference, I implemented use_after_free::supercedes_p in commit
g:33255ad3ac14e3953750fe0f2d82b901c2852ff6 as part of the gcc 12
(re)implementation of -Wanalyzer-use-of-uninitialized-value.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug analyzer/110830] -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p.
2023-07-27 12:41 [Bug analyzer/110830] New: -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p vultkayn at gcc dot gnu.org
2023-07-31 22:40 ` [Bug analyzer/110830] " dmalcolm at gcc dot gnu.org
@ 2023-07-31 22:43 ` dmalcolm at gcc dot gnu.org
2023-09-07 21:02 ` cvs-commit at gcc dot gnu.org
2 siblings, 0 replies; 4+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2023-07-31 22:43 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110830
--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
The "supercedes_p" logic is called in
diagnostic_manager::emit_saved_diagnostics here:
best_candidates.handle_interactions (this);
I *think* every saved_diagnostic ought to have a non-NULL m_best_epath by the
time this is called.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug analyzer/110830] -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p.
2023-07-27 12:41 [Bug analyzer/110830] New: -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p vultkayn at gcc dot gnu.org
2023-07-31 22:40 ` [Bug analyzer/110830] " dmalcolm at gcc dot gnu.org
2023-07-31 22:43 ` dmalcolm at gcc dot gnu.org
@ 2023-09-07 21:02 ` cvs-commit at gcc dot gnu.org
2 siblings, 0 replies; 4+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2023-09-07 21:02 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110830
--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The trunk branch has been updated by Benjamin Priour <vultkayn@gcc.gnu.org>:
https://gcc.gnu.org/g:7d2274b9e346f44f8f6598b9dbb9fa95259274a2
commit r14-3794-g7d2274b9e346f44f8f6598b9dbb9fa95259274a2
Author: benjamin priour <vultkayn@gcc.gnu.org>
Date: Fri Sep 1 20:21:41 2023 +0200
analyzer: Call off a superseding when diagnostics are unrelated [PR110830]
Before this patch, a saved_diagnostic would supersede another at
the same statement if and only its vfunc supercedes_p returned true
for the other diagnostic's kind.
That both warning were unrelated - i.e. resolving one would not fix
the other - was not considered in making the above choice.
This patch makes it so that two saved_diagnostics taking a different
outcome of at least one common conditional branching cannot supersede
each other.
Signed-off-by: Benjamin Priour <vultkayn@gcc.gnu.org>
Co-authored-by: David Malcolm <dmalcolm@redhat.com>
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
gcc/analyzer/ChangeLog:
PR analyzer/110830
* diagnostic-manager.cc
(compatible_epaths_p): New function.
(saved_diagnostic::supercedes_p): Now calls the above
to determine if the diagnostics do overlap and the superseding
may proceed.
gcc/testsuite/ChangeLog:
PR analyzer/110830
* c-c++-common/analyzer/pr110830.c: New test.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-09-07 21:02 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-27 12:41 [Bug analyzer/110830] New: -Wanalyzer-use-of-uninitialized-value false negative due to use-after-free::supercedes_p vultkayn at gcc dot gnu.org
2023-07-31 22:40 ` [Bug analyzer/110830] " dmalcolm at gcc dot gnu.org
2023-07-31 22:43 ` dmalcolm at gcc dot gnu.org
2023-09-07 21:02 ` cvs-commit at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).