[Bug sanitizer/65280] -fsanitize=bounds does not detect out-of-bounds access

[Bug sanitizer/65280] -fsanitize=bounds does not detect out-of-bounds access

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65280

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2015-03-02
           Assignee|unassigned at gcc dot gnu.org      |mpolacek at gcc dot gnu.org
   Target Milestone|---                         |5.0
     Ever confirmed|0                           |1

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Patch here <https://gcc.gnu.org/ml/gcc-patches/2015-02/msg01569.html>.

[Bug sanitizer/65280] New: -fsanitize=bounds does not detect out-of-bounds access

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65280

            Bug ID: 65280
           Summary: -fsanitize=bounds does not detect out-of-bounds access
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: mpolacek at gcc dot gnu.org
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org

void
foo (int n, int (*b)[n])
{
  (*b)[n] = 1;
}

int
main ()
{
  int a[20];
  foo (3, (int (*)[3]) &a);
}

We issue no runtime error here, while clang says:
u.c:5:2: runtime error: index 3 out of bounds for type 'int [n]'

[Bug sanitizer/65280] -fsanitize=bounds does not detect out-of-bounds access

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65280

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Fixed for GCC 5.

[Bug sanitizer/65280] -fsanitize=bounds does not detect out-of-bounds access

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65280

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Author: mpolacek
Date: Fri Mar  6 23:44:56 2015
New Revision: 221250

URL: https://gcc.gnu.org/viewcvs?rev=221250&root=gcc&view=rev
Log:
    PR sanitizer/65280
    * doc/invoke.texi: Update description of -fsanitize=bounds.

    * c-ubsan.c (ubsan_instrument_bounds): Check for COMPONENT_REF
    before trying to figure out whether we have a flexible array member.

    * c-c++-common/ubsan/bounds-1.c: Add testing of flexible array
    member-like arrays.
    * c-c++-common/ubsan/bounds-8.c: New test.
    * c-c++-common/ubsan/bounds-9.c: New test.
    * gcc.dg/ubsan/bounds-2.c: New test.

Added:
    trunk/gcc/testsuite/c-c++-common/ubsan/bounds-8.c
    trunk/gcc/testsuite/c-c++-common/ubsan/bounds-9.c
    trunk/gcc/testsuite/gcc.dg/ubsan/bounds-2.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/c-family/ChangeLog
    trunk/gcc/c-family/c-ubsan.c
    trunk/gcc/doc/invoke.texi
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/testsuite/c-c++-common/ubsan/bounds-1.c