public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug middle-end/113540] New: missing -Warray-bounds warning with malloc and a simple loop
@ 2024-01-22 14:33 vincent-gcc at vinc17 dot net
2024-01-23 7:43 ` [Bug middle-end/113540] " rguenth at gcc dot gnu.org
2024-01-23 8:55 ` vincent-gcc at vinc17 dot net
0 siblings, 2 replies; 3+ messages in thread
From: vincent-gcc at vinc17 dot net @ 2024-01-22 14:33 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113540
Bug ID: 113540
Summary: missing -Warray-bounds warning with malloc and a
simple loop
Product: gcc
Version: 14.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: middle-end
Assignee: unassigned at gcc dot gnu.org
Reporter: vincent-gcc at vinc17 dot net
Target Milestone: ---
Consider the following code:
#include <stdlib.h>
int main (void)
{
volatile char *t;
t = malloc (4);
for (int i = 0; i <= 4; i++)
t[i] = 0;
return 0;
}
With -O2 -Warray-bounds, I do not get any warning.
Replacing the loop by "t[4] = 0;" gives a warning "array subscript 4 is outside
array bounds of 'volatile char[4]'" as expected.
Or replacing the use of malloc() by "volatile char t[4];" also gives a warning.
Tested with gcc (Debian 20240117-1) 14.0.1 20240117 (experimental) [master
r14-8187-gb00be6f1576]. But previous versions do not give any warning either.
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Bug middle-end/113540] missing -Warray-bounds warning with malloc and a simple loop
2024-01-22 14:33 [Bug middle-end/113540] New: missing -Warray-bounds warning with malloc and a simple loop vincent-gcc at vinc17 dot net
@ 2024-01-23 7:43 ` rguenth at gcc dot gnu.org
2024-01-23 8:55 ` vincent-gcc at vinc17 dot net
1 sibling, 0 replies; 3+ messages in thread
From: rguenth at gcc dot gnu.org @ 2024-01-23 7:43 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113540
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |56456
Keywords| |diagnostic
Status|UNCONFIRMED |NEW
Ever confirmed|0 |1
Last reconfirmed| |2024-01-23
--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
If you remove the volatile, like
#include <stdlib.h>
char *foo (void)
{
char *t;
t = malloc (4);
for (int i = 0; i <= 4; i++)
t[i] = 0;
return t;
}
you get
t.c: In function 'foo':
t.c:8:10: warning: '__builtin_memset' writing 5 bytes into a region of size 4
[-Wstringop-overflow=]
8 | t[i] = 0;
| ~~~~~^~~
t.c:6:7: note: destination object of size 4 allocated by 'malloc'
6 | t = malloc (4);
| ^~~~~~~~~~
note this is because we then unroll the loop. If you change it like
#include <stdlib.h>
short *foo (void)
{
short *t;
t = malloc (8);
for (int i = 0; i <= 4; i++)
t[i] = 13;
return t;
}
you get
t.c: In function 'foo':
t.c:8:6: warning: array subscript 4 is outside array bounds of 'short int[4]'
[-Warray-bounds=]
8 | t[i] = 13;
| ~^~~
t.c:6:7: note: at offset 8 into object of size 8 allocated by 'malloc'
6 | t = malloc (8);
| ^~~~~~~~~~
because we unroll the loop. Upping the bounds like
#include <stdlib.h>
short *foo (void)
{
short *t;
t = malloc (64);
for (int i = 0; i <= 32; i++)
t[i] = 13;
return t;
}
no longer warns because we hit unroll limits. This is also the reason
we do not diagnose the original testcase - there's currently no analysis
done to compute the set of values 'i' must reach for the purpose of
array-bound diagnostics. Instead we use value-ranges which are
conservative, aka [-INF, INF] is "correct". But that means we only
diagnose cases where _all_ values of the range fall outside of the
array.
Using niter analysis and SCEV we could do a better job in cases like the
one in this bug.
I'm quite sure we have related/duplicate bugreports for this already.
Referenced Bugs:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56456
[Bug 56456] [meta-bug] bogus/missing -Warray-bounds
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Bug middle-end/113540] missing -Warray-bounds warning with malloc and a simple loop
2024-01-22 14:33 [Bug middle-end/113540] New: missing -Warray-bounds warning with malloc and a simple loop vincent-gcc at vinc17 dot net
2024-01-23 7:43 ` [Bug middle-end/113540] " rguenth at gcc dot gnu.org
@ 2024-01-23 8:55 ` vincent-gcc at vinc17 dot net
1 sibling, 0 replies; 3+ messages in thread
From: vincent-gcc at vinc17 dot net @ 2024-01-23 8:55 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113540
--- Comment #2 from Vincent Lefèvre <vincent-gcc at vinc17 dot net> ---
Thanks for the explanations, but why in the following case
void foo (void)
{
volatile char t[4];
for (int i = 0; i <= 4; i++)
t[i] = 0;
return;
}
does one get the warning (contrary to the use of malloc)?
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-01-23 8:55 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-01-22 14:33 [Bug middle-end/113540] New: missing -Warray-bounds warning with malloc and a simple loop vincent-gcc at vinc17 dot net
2024-01-23 7:43 ` [Bug middle-end/113540] " rguenth at gcc dot gnu.org
2024-01-23 8:55 ` vincent-gcc at vinc17 dot net
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).