From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id CBF5B3858C78; Wed, 6 Sep 2023 12:18:19 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org CBF5B3858C78 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1694002699; bh=rBNaO/lEi/rP+/amzzca7CDZNOWhogqHltg1ikrVaxA=; h=From:To:Subject:Date:From; b=eLlUqgk4/cFtlgK+ZMtIUkgujCwXEE9Yckx5O9QDRQmnp5QiELlkS5NM/pzJYfQYK KffuLisZ1Zs79+Qv2wzNG2mY3IdradyJSCuSdV09CLc6bv49b+liGHhraV0nuzpCzi EwTW9krMUjfJdMKYfcvT01F6S1Zfyr0bZpmSYxis= From: "geoffreydgr at icloud dot com" To: gcc-bugs@gcc.gnu.org Subject: [Bug analyzer/111305] New: GCC Static Analyzer -Wanalyzer-out-of-bounds FP and ICE problem Date: Wed, 06 Sep 2023 12:18:19 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: analyzer X-Bugzilla-Version: 14.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: geoffreydgr at icloud dot com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: dmalcolm at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter target_milestone Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D111305 Bug ID: 111305 Summary: GCC Static Analyzer -Wanalyzer-out-of-bounds FP and ICE problem Product: gcc Version: 14.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: analyzer Assignee: dmalcolm at gcc dot gnu.org Reporter: geoffreydgr at icloud dot com Target Milestone: --- ICE bug when analyzing the folowing program. And there also is a FP report = of out-of-bounds.=20 cmd: gcc -O0 -fanalyzer gcc version: x86-64 gcc (trunk) see it live: https://godbolt.org/z/qKxde131e ``` #include #include struct a { uint32_t b; }; union c { int8_t b; }; int32_t *d( int32_t *j, int32_t k, struct a l) { int64_t m[1]=3D {0}; for (l.b =3D 0; l.b <=3D 0; l.b++) { printf("FLAG\n"); l.b =3D=3D 12 && m[l.b]; } } ``` out: ``` : In function 'd': :15:19: warning: stack-based buffer over-read [CWE-121] [-Wanalyzer-out-of-bounds] 15 | l.b =3D=3D 12 && m[l.b]; | ~^~~~~ 'd': events 1-10 | | 12 | int64_t m[1]=3D {0}; | | ^ | | | | | (1) capacity: 8 bytes | 13 | for (l.b =3D 0; l.b <=3D 0; l.b++) { | | ~~~~~~~~ | | | | | (2) following 'true' branch... | | (6) following 'true' branch... | 14 | printf("FLAG\n"); | | ~~~~~~~~~~~~~~~~ | | | | | (3) ...to here | | (7) ...to here | 15 | l.b =3D=3D 12 && m[l.b]; | | ~~~~~~~~~~~~~~~~~~~ | | | | | | | | | (9) ...to here | | | (10) read of 8 bytes at offset 'l.b * 8' exc= eeds 'm' | | (4) following 'false' branch... | | (5) ...to here | | (8) following 'true' branch... | :15:19: note: valid subscripts for 'm' are '[0]' to '[0]' 15 | l.b =3D=3D 12 && m[l.b]; | ~^~~~~ during IPA pass: analyzer :15:15: internal compiler error: in decompose, at wide-int.h:990 15 | l.b =3D=3D 12 && m[l.b]; | ~~~~~~~~~~^~~~~~~~~ 0x21af71e internal_error(char const*, ...) ???:0 0x9dd814 fancy_abort(char const*, int, char const*) ???:0 0x185a343 tree_zero_one_valued_p(tree_node*) ???:0 0x214b222 generic_simplify_MULT_EXPR(unsigned int, tree_code, tree_node*, tree_node*, tree_node*) ???:0 0xce1d05 fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*, tree_node*) ???:0 0xce96cd fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*, tree_node*) ???:0 0x18f3716 generic_simplify_23(unsigned int, tree_node*, tree_node*, tree_no= de*, tree_node**, tree_code) ???:0 0x186889c generic_simplify_PLUS_EXPR(unsigned int, tree_code, tree_node*, tree_node*, tree_node*) ???:0 0xce1d05 fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*, tree_node*) ???:0 0xce96cd fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*, tree_node*) ???:0 0x21505bf generic_simplify_MULT_EXPR(unsigned int, tree_code, tree_node*, tree_node*, tree_node*) ???:0 0xce1d05 fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*, tree_node*) ???:0 0xce96cd fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*, tree_node*) ???:0 0x14d2c3f ana::region_offset::calc_symbolic_bit_offset(ana::region_model const&) const ???:0 0x217faff ana::access_range::get_size(ana::region_model const&, ana::bit_size_expr*) const ???:0 0x218cad3 ana::access_diagram_impl::access_diagram_impl(ana::access_operati= on const&, diagnostic_event_id_t, text_art::style_manager&, text_art::theme const&, ana::logger*) ???:0 0x2180abb ana::access_diagram::access_diagram(ana::access_operation const&, diagnostic_event_id_t, text_art::style_manager&, text_art::theme const&, ana::logger*) ???:0 0x2111f43 ana::symbolic_buffer_over_read::emit(rich_location*, ana::logger*) ???:0 0x2139d1e ana::diagnostic_manager::emit_saved_diagnostic(ana::exploded_graph const&, ana::saved_diagnostic&) ???:0 0x213a520 ana::diagnostic_manager::emit_saved_diagnostics(ana::exploded_gra= ph const&) ???:0 Please submit a full bug report, with preprocessed source (by using -freport-bug). Please include the complete backtrace with any bug report. See for instructions. Compiler returned: 1 ```=