[Bug analyzer/111266] New: Missing -Wanalyzer-out-of-bounds for concrete offset overwrite.

[Bug analyzer/111266] New: Missing -Wanalyzer-out-of-bounds for concrete offset overwrite.

[vultkayn at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111266

            Bug ID: 111266
           Summary: Missing -Wanalyzer-out-of-bounds for concrete offset
                    overwrite.
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: vultkayn at gcc dot gnu.org
  Target Milestone: ---

Hi,

The analyzer do not emit the expected "heap-based write overflow" in the
reproducer below.

#include <stdint.h>
void *malloc (__SIZE_TYPE__);
void free (void *);

void test_binop2 ()
{
  char *p = (char *) malloc (4);
  int32_t *i = (int32_t *) (p + 3);
  *i = 20042; /* { dg-warning "heap-based buffer overflow" "" { xfail *-*-* } }
*/
  free (p);
}


A quick investigation showed that on *i = 20042, check_region_bounds had the
following:

reg is an offset_region(heap_allocated(12), 'int32_', 3) as expected
base_reg is heap_allocated(12)
base_reg's capacity is correct too, and reg_offset *is* 3 bytes, as it should.

The issue comes from num_bytes_sval, which corresponds to the number of bytes
accessed. It should be a constant_svalue of value 4, but is instead of value 1.

Therefore the "read_bytes" byte_range do not overflow the buffer, as we get
(offset) 3 + (accessed bytes) 1 = 4, which is not an overflow (3 + 4 expected)

[Bug analyzer/111266] [13/14 Regression] Missing -Wanalyzer-out-of-bounds for concrete offset overwrite.

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111266

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
                 CC|                            |dmalcolm at gcc dot gnu.org
   Last reconfirmed|                            |2024-02-15
            Summary|Missing                     |[13/14 Regression] Missing
                   |-Wanalyzer-out-of-bounds    |-Wanalyzer-out-of-bounds
                   |for concrete offset         |for concrete offset
                   |overwrite.                  |overwrite.

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this; confirmed:
  Trunk: https://godbolt.org/z/jzevK9cTz
  GCC 13.2: https://godbolt.org/z/6jx87aqn6

[Bug analyzer/111266] [13/14 Regression] Missing -Wanalyzer-out-of-bounds for concrete offset overwrite.

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111266

--- Comment #2 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:617bd59c659dcf6e5391409a2e9f64f75e905a96

commit r14-9018-g617bd59c659dcf6e5391409a2e9f64f75e905a96
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Feb 15 16:01:36 2024 -0500

    analyzer: remove offset_region size overloads [PR111266]

    PR analyzer/111266 reports a missing -Wanalyzer-out-of-bounds when
    accessing relative to a concrete byte offset.

    Root cause is that offset_region::get_{byte,bit}_size_sval were
    attempting to compute the size that's valid to access, rather than the
    size of the access attempt.

    Fixed by removing these vfunc overrides from offset_region as the
    base class implementation does the right thing.

    gcc/analyzer/ChangeLog:
            PR analyzer/111266
            * region.cc (offset_region::get_byte_size_sval): Delete.
            (offset_region::get_bit_size_sval): Delete.
            * region.h (region::get_byte_size): Add comment clarifying that
            this relates to the size of the access, rather than the size
            that's valid to access.
            (region::get_bit_size): Likewise.
            (region::get_byte_size_sval): Likewise.
            (region::get_bit_size_sval): Likewise.
            (offset_region::get_byte_size_sval): Delete.
            (offset_region::get_bit_size_sval): Delete.

    gcc/testsuite/ChangeLog:
            PR analyzer/111266
            * c-c++-common/analyzer/out-of-bounds-pr111266.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/111266] [13 Regression] Missing -Wanalyzer-out-of-bounds for concrete offset overwrite.

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111266

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[13/14 Regression] Missing  |[13 Regression] Missing
                   |-Wanalyzer-out-of-bounds    |-Wanalyzer-out-of-bounds
                   |for concrete offset         |for concrete offset
                   |overwrite.                  |overwrite.
             Status|NEW                         |ASSIGNED

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed on trunk by the above patch.

Keeping open to track backport to gcc 13 branch.

[Bug analyzer/111266] [13 Regression] Missing -Wanalyzer-out-of-bounds for concrete offset overwrite.

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111266

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.3

[Bug analyzer/111266] [13 Regression] Missing -Wanalyzer-out-of-bounds for concrete offset overwrite.

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111266

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug analyzer/111266] [13 Regression] Missing -Wanalyzer-out-of-bounds for concrete offset overwrite.

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111266

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|13.3                        |13.4

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 13.3 is being released, retargeting bugs to GCC 13.4.