[Bug analyzer/95043] New: GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);'

[Bug analyzer/95043] New: GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);'

[noloader at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95043

            Bug ID: 95043
           Summary: GCC 10 Analyzer and false positive on 'memcpy(dest,
                    src, count);'
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: noloader at gmail dot com
  Target Milestone: ---

Created attachment 48500
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48500&action=edit
Preprocessed source file idea.ii

Hi Everyone,

I'm trying out the analyzer on a C++ project. I'm working on Fedora 32 with GCC
10.

  $ gcc --version
  gcc (GCC) 10.0.1 20200430 (Red Hat 10.0.1-0.14)

Here's what I am seeing:

    |  527 |  if (src && dest)
    |      |  ~~
    |      |  |
    |      |  (9) ...to here
    |      |  (10) following ‘true’ branch...
    |  528 |   memcpy(dest, src, count);
    |      |   ~~~~~~~~~~~~~~~~~~~~~~~~
    |      |   |     |
    |      |   |     (12) argument 1 (‘dest’) NULL where non-null expected

Here's the source file:
https://github.com/weidai11/cryptopp/blob/master/misc.h#L506. And the function
(with extra noise omitted):

inline void memcpy_s(void *dest, size_t sizeInBytes, const void *src, size_t
count)
{
    if (count > sizeInBytes)
        throw InvalidArgument("memcpy_s: buffer overflow");

    if (src && dest)
        memcpy(dest, src, count);
}

I have not been able to reproduce this with a reproducer. The reproducer shown
below fails to tickle the issue.

Attached is the preprocessed source file with the problem, idea.ii.tar.gz.

==========

The reproducer shown below fails to reproduce the issue.

$ cat test.cxx
#include <cstddef>
#include <stdexcept>
#include <cstring>
#include <memory>

inline void
my_memcpy(void* dest, size_t sizeInBytes, const void* src, size_t count)
{
    if (count > sizeInBytes)
        throw std::runtime_error("Overflow");

    if(dest && src)
        memcpy(dest, src, count);
}

int main(int argc, char* argv[])
{
    char buf[16];
    my_memcpy(NULL, 16, argv[0], strlen(argv[0]));
    return 0;
}

[Bug analyzer/95043] GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);'

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95043

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2020-05-11
     Ever confirmed|0                           |1
                 CC|                            |marxin at gcc dot gnu.org

[Bug analyzer/95043] GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);'

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95043

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Please note that C++ isn't supported in the GCC 10 implementation of -fanalyzer
(I hope to do so for GCC 11, but there's a lot of work to do).

In particular, I haven't implemented exceptions yet.

[Bug analyzer/95043] GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);'

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95043

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |UNCONFIRMED
     Ever confirmed|1                           |0

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
I can reproduce a warning with the preprocessed source with gcc 10 at -O1 and
above; stripping out the line-markers with:
  perl -pi -e 's/^#.*\n//g;' idea.ii
I get:
  https://godbolt.org/z/qxehzM

which shows a diagnostic, where (I think) m_array is NULL from
m_fallbackAllocator.allocate, which looks like a valid warning.

With gcc 11, -Wanalyzer-too-complex shows that the analyzer is hitting the
complexity limit and bailing out, without emitting the diagnostic.

[Bug analyzer/95043] GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);'

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95043

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |WORKSFORME

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
I'm not able to reproduce this with gcc 11, and I wasn't able to reduce the gcc
10 reproducer.  Perhaps fixed by the big state rewrite of gcc 11 (although C++
is still not supported by -fanalyzer, sorry).

Closing this out as "WORKSFORME"; feel free to reopen if you're able to
reproduce with gcc 11.