[Bug sanitizer/115590] New: Bad dereferences through -> operator not detected by sanitizers

[Bug sanitizer/115590] New: Bad dereferences through -> operator not detected by sanitizers

[nrk at disroot dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115590

            Bug ID: 115590
           Summary: Bad dereferences through -> operator not detected by
                    sanitizers
           Product: gcc
           Version: 14.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: nrk at disroot dot org
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org
  Target Milestone: ---

Minimal testcase:

        int main(void)
        {
                struct { int v; } *p = 0;
                p->v;
                return 0;
        }

Compile and run with:

        [/tmp]~> gcc -fsanitize=address,undefined -O0 -o test ./test.c &&
./test

Doesn't detect the null pointer deref. Same with clang:

        [/tmp]~> clang -fsanitize=address,undefined -O0 -o test ./test.c &&
./test
        ./test.c:4:5: warning: expression result unused [-Wunused-value]
                p->v;
                ~  ^
        1 warning generated.
        test.c:4:5: runtime error: member access within null pointer of type
'struct (unnamed struct at ./test.c:3:2)'
        SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior test.c:4:5 in 
        test.c:4:5: runtime error: load of null pointer of type 'int'
        SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior test.c:4:5 in

[Bug sanitizer/115590] Bad dereferences through -> operator not detected by sanitizers

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115590

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
In this case we remove the load early on even at -O0.
Way before address santiizer annotates the load.

I am not 100% sure want to keep these around even at -O0 since they don't have
any behavior effect.

[Bug sanitizer/115590] Bad dereferences through -> operator not detected by sanitizers

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115590

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Note if you assign it to a temporary, GCC will catch it at -O0.

[Bug sanitizer/115590] Bad dereferences through -> operator not detected by sanitizers

[nrk at disroot dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115590

--- Comment #3 from nrk at disroot dot org ---
> I am not 100% sure want to keep these around even at -O0 since they don't have any behavior effect.

I'd strongly argue that if you're using sanitizers, you'd want these to be
caught :)

Also worth noting that bad array deref gets caught even if they don't have any
effect:

        [/tmp]~> cat test.c
        int main(void)
        {
                int v[1];
                v[1];
                return 0;
        }
        [/tmp]~> gcc -fsanitize=address,undefined -O0 -o test ./test.c &&
./test
        test.c:4:3: runtime error: index 1 out of bounds for type 'int [1]'