[Bug analyzer/94839] New: False positive with -fanalyzer and direct field assignment from calloc

[Bug analyzer/94839] New: False positive with -fanalyzer and direct field assignment from calloc

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94839

            Bug ID: 94839
           Summary: False positive with -fanalyzer and direct field
                    assignment from calloc
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Keywords: diagnostic
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: pinskia at gcc dot gnu.org
  Target Milestone: ---

Take:
struct bitmap
{
  int min;
  int max;
  int *vec;
};


int bitmap_create(struct bitmap *bm, int min, int max)
{
        int sz;

        sz = (max / sizeof(int)) + 1;

        bm->min = min;
        bm->max = max;
        bm->vec = __builtin_calloc(sz, sizeof(int));
        if (!bm->vec)
                return (-12);
        return 0;
}

----- CUT ----
This gives (at -O2 -fanalyzer -W -Wall ):
In function ‘bitmap_create’:
t6666_1.c:18:12: warning: leak of ‘<unknown>’ [CWE-401]
[-Wanalyzer-malloc-leak]
   18 |         if (!bm->vec)
      |            ^
  ‘bitmap_create’: events 1-3
    |
    |   13 |         sz = (max / sizeof(int)) + 1;
    |      |              ~~~~~^~~~~~~~~~~~~~
    |      |                   |
    |      |                   (1) allocated here
    |......
    |   18 |         if (!bm->vec)
    |      |            ~
    |      |            |
    |      |            (2) assuming ‘<unknown>’ is non-NULL
    |      |            (3) following ‘false’ branch...
    |
  ‘bitmap_create’: event 4
    |
    |cc1:
    | (4): ...to here
    |
  ‘bitmap_create’: event 5
    |
    |   18 |         if (!bm->vec)
    |      |            ^
    |      |            |
    |      |            (5) ‘<unknown>’ leaks here; was allocated at (1)
    |

Except there is no leaking as assign the calloc to bm->vec .

If we change the type of vec to void*, there is no warning.

[Bug analyzer/94839] False positive with -fanalyzer and direct field assignment from calloc

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94839

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends on|                            |94640

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
This seems related to PR 94640 even.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94640
[Bug 94640] false-positive leaking FILE pointer assigned to function passed
pointer

[Bug analyzer/94839] False positive with -fanalyzer and direct field assignment from calloc

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94839
Bug 94839 depends on bug 94640, which changed state.

Bug 94640 Summary: false-positive leaking FILE pointer assigned to function passed pointer
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94640

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

[Bug analyzer/94839] False positive with -fanalyzer and direct field assignment from calloc

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94839

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
The leak false positive should be fixed by
g:808f4dfeb3a95f50f15e71148e5c1067f90a126d (for GCC 11).  Marking this as
fixed.