From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 27771 invoked by alias); 15 Apr 2013 10:19:26 -0000 Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Id: List-Archive: List-Post: List-Help: Sender: gcc-bugs-owner@gcc.gnu.org Received: (qmail 27744 invoked by uid 48); 15 Apr 2013 10:19:23 -0000 From: "rguenth at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug other/56955] documentation for attribute malloc contradicts itself Date: Mon, 15 Apr 2013 10:19:00 -0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: other X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: rguenth at gcc dot gnu.org X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated Content-Type: text/plain; charset="UTF-8" MIME-Version: 1.0 X-SW-Source: 2013-04/txt/msg01449.txt.bz2 http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56955 --- Comment #3 from Richard Biener 2013-04-15 10:19:22 UTC --- (In reply to comment #2) > (In reply to comment #1) > > I think it is talking about the memory returned by malloc/calloc will not point > > to another memory location while realloc can. > > I agree that's essentially what it ought to talk about, and the bug is that > it's talking about something else -- the contents of the pointed-to memory. Well, it _is_ actually about the content. There must be no way to compute a valid pointer to another object from the contents of the pointed-to memory. So if you initialize the memory to {0, 1, 2, 3, 4 ...} thus every possible byte value is somewhere and then do void *p = (void *)(mem[3] << 24 | mem[58] << 16 | ...); then points-to analysis assumes that from the contents of 'mem' you can only compute pointers to nothing (NULL). Technically for targets where NULL is a valid poiner to an object calloc () may not be marked with malloc. That is, read it in the way that the code assumes the memory _may_ be zero-initialized (but only zero-initialized) or uninitialized.