From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugs-return-477478-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Received: (qmail 20813 invoked by alias); 16 Feb 2015 18:22:49 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Received: (qmail 20751 invoked by uid 48); 16 Feb 2015 18:22:45 -0000
From: "larsbj at gullik dot net" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug sanitizer/65081] New: -fsanitize=object-size fails with simple pointer arithm
Date: Mon, 16 Feb 2015 18:22:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: sanitizer
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: larsbj at gullik dot net
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter cc
Message-ID: <bug-65081-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-02/txt/msg01811.txt.bz2

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65081

            Bug ID: 65081
           Summary: -fsanitize=object-size fails with simple pointer
                    arithm
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: larsbj at gullik dot net
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org

With:

gcc (GCC) 5.0.0 20150216 (experimental) as of 220738

and this test snippet:

-----------

struct intro {
    int a;
    char pad_[1];
};

struct intro b;

struct intro * alloc()
{
    struct intro * i = &b;
    return i + 1;
}

int main(void)
{
    struct intro * i = alloc() - 1;
    i->a = 1;
}
-----------

I get this report:

test.c:17:10: runtime error: store to address 0x0000006010a0 with insufficient
space for an object of type 'int'
0x0000006010a0: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00  00 00 00 00
              ^

When compiled like this:

 gcc -O1 -fsanitize=object-size test.c

-fno-inline removes the runtime error, as do removing the pad_ from the intro
struct.

This is possibly an duplicate of bug 63303, but the errors are quite different.