[Bug middle-end/48558] New: -Warray-bounds fails o detect the out of bound array access

[Bug middle-end/48558] New: -Warray-bounds fails o detect the out of bound array access

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48558

           Summary: -Warray-bounds fails o detect the out of bound array
                    access
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: hjl.tools@gmail.com


bfd/elf32-i386.c in binutils has

   case BFD_RELOC_386_IRELATIVE:
      TRACE ("BFD_RELOC_386_IRELATIVE");
      return &elf_howto_table[R_386_IRELATIVE];

It should be:

      return &elf_howto_table[R_386_IRELATIVE - R_386_tls_offset];

GCC fails to detect it.

[Bug middle-end/48558] -Warray-bounds fails to detect the out of bound array access

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48558

--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> 2011-04-11 18:40:07 UTC ---
A testcase:

[hjl@gnu-6 bfd]$ cat x.c 
enum bfd_reloc_code_real {
  BFD_RELOC_386_IRELATIVE
};
typedef enum bfd_reloc_code_real bfd_reloc_code_real_type;
typedef const struct reloc_howto_struct reloc_howto_type;
struct reloc_howto_struct
{
  unsigned int type;
};
enum elf_i386_reloc_type {
     R_386_IRELATIVE = 42,
};
static reloc_howto_type elf_howto_table[]=
{
  {
    (unsigned) R_386_IRELATIVE
  }
};
reloc_howto_type *
elf_i386_reloc_type_lookup (bfd_reloc_code_real_type code)
{
  switch (code)
    {
    case BFD_RELOC_386_IRELATIVE:
      return &elf_howto_table[R_386_IRELATIVE];
    default:
      break;
    }
  return 0;
}
[hjl@gnu-6 bfd]$ /usr/gcc-4.7.0-x32/bin/gcc  -O3 -S -Wall x.c -Warray-bounds 
[hjl@gnu-6 bfd]$

[Bug middle-end/48558] -Warray-bounds fails to detect the out of bound array access

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48558

--- Comment #2 from H.J. Lu <hjl.tools at gmail dot com> 2011-04-11 19:09:54 UTC ---
A simple change from

return &elf_howto_table[R_386_IRELATIVE];

to

return elf_howto_table[R_386_IRELATIVE];

makes GCC to warn:

[hjl@gnu-6 bfd]$ cat x.c
enum bfd_reloc_code_real {
  BFD_RELOC_386_IRELATIVE
};
typedef enum bfd_reloc_code_real bfd_reloc_code_real_type;
typedef const struct reloc_howto_struct reloc_howto_type;
struct reloc_howto_struct
{
  unsigned int type;
};
enum elf_i386_reloc_type {
     R_386_IRELATIVE = 42,
};
static reloc_howto_type elf_howto_table[]=
{
  {
    (unsigned) R_386_IRELATIVE
  }
};
reloc_howto_type
elf_i386_reloc_type_lookup (bfd_reloc_code_real_type code)
{
  switch (code)
    {
    case BFD_RELOC_386_IRELATIVE:
      return elf_howto_table[R_386_IRELATIVE];
    default:
      break;
    }
  return elf_howto_table[0];
}
[hjl@gnu-6 bfd]$ /usr/gcc-4.7.0-x32/bin/gcc  -O3 -S -Wall x.c -Warray-bounds 
x.c: In function ‘elf_i386_reloc_type_lookup’:
x.c:25:29: warning: array subscript is above array bounds [-Warray-bounds]
[hjl@gnu-6 bfd]$

[Bug middle-end/48558] -Warray-bounds fails to detect the out of bound array access

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48558

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |diagnostic
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2011.04.12 10:28:18
     Ever Confirmed|0                           |1
           Severity|normal                      |enhancement

--- Comment #3 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-04-12 10:28:18 UTC ---
Confirmed.