[Bug middle-end/94169] New: warn for modifying getenv() result

[Bug middle-end/94169] New: warn for modifying getenv() result

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94169

            Bug ID: 94169
           Summary: warn for modifying getenv() result
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: enhancement
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: msebor at gcc dot gnu.org
  Target Milestone: ---

Bug 94157 was caused by modifying the string pointed to by the value returned
from getenv(), which is undefined according to both C and POSIX.  C11 says in
7.22.4.8, p4:

  The getenv function returns a pointer to a string associated with the matched
list member. The string pointed to shall not be modified by the program, but
may be overwritten by a subsequent call to the getenv function.

It would be helpful if GCC issued a warning for attempts to modify the returned
string.  This could be done by extending -Wstringop-overflow.

[Bug middle-end/94169] warn for modifying getenv() result

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94169

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|88781                       |

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
On second thought, rather than extending -Wstringop-overflow it might be better
to diagnoses this under "modifying a const object" as requested in 90404.  In
addition, rather than diagnosing only built-in functions (and growing the list
GCC would have to recognize just to detect bugs), providing an attribute to let
users denote pointers to non-modifiable objects would be a better solution.  It
could be an entirely new attribute or it could be done by extending the
existing access attribute read_only to apply also to pointers returned from
functions and even to data members.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88781
[Bug 88781] [meta-bug] bogus/missing -Wstringop-truncation warnings

[Bug middle-end/94169] warn for modifying getenv() result

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94169

--- Comment #2 from Martin Sebor <msebor at gcc dot gnu.org> ---
Other C standard functions that return a pointer to an unmodifiable object:

  localeconv(), setlocale(), strerror()

In addition, stdin, stdout, and stderr could be marked as pointing to read-only
(although uses by standard library macros would have to be exempted).

and POSIX:

  ctermid()
  dlerror()
  getgrent()
  gethostent()
  getnetbyaddr(), getnetbyname(), getnetent()
  getprotbyname(), getprotbynumber(), getprotent()
  getpwent(), getpwnam(), getpwuid(),
  getservbyname(), getservbyport(), getservent()
  getutxent(), getutxid(), getutxline()
  getgrid(), getgrnam(), getlogin()
  getsubopt() (object pointed to by second argument)
  nl_langinfo()
  ptsname()
  readdir()
  strsignal()
  ttyname()

[Bug middle-end/94169] warn for modifying getenv() result

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94169

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dmalcolm at gcc dot gnu.org

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
In terms of the history here, is it the case that all of these functions really
ought to return a "const char *" to the caller, but were already standardized
as returning plain "char *"?

[Bug middle-end/94169] warn for modifying getenv() result

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94169

--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> ---
Yes.  The recent proposal to change their signature to return const char* was 
rejected in WG14 thanks to source compatibility concerns:

http://www.open-std.org/jtc1/sc22/wg14/www/docs/n2526.htm
http://www.open-std.org/jtc1/sc22/wg14/www/docs/n2565.pdf

I'm thinking of extending attribute access to annotate function return types
similarly to function arguments.  Another useful attribute is one that says:
the function returns a pointer passed to it by argument N, plus some offset
(with the offset being optional, and also specified by an argument).