[Bug analyzer/95043] New: GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);'

["noloader at gmail dot com" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95043

            Bug ID: 95043
           Summary: GCC 10 Analyzer and false positive on 'memcpy(dest,
                    src, count);'
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: noloader at gmail dot com
  Target Milestone: ---

Created attachment 48500
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48500&action=edit
Preprocessed source file idea.ii

Hi Everyone,

I'm trying out the analyzer on a C++ project. I'm working on Fedora 32 with GCC
10.

  $ gcc --version
  gcc (GCC) 10.0.1 20200430 (Red Hat 10.0.1-0.14)

Here's what I am seeing:

    |  527 |  if (src && dest)
    |      |  ~~
    |      |  |
    |      |  (9) ...to here
    |      |  (10) following ‘true’ branch...
    |  528 |   memcpy(dest, src, count);
    |      |   ~~~~~~~~~~~~~~~~~~~~~~~~
    |      |   |     |
    |      |   |     (12) argument 1 (‘dest’) NULL where non-null expected

Here's the source file:
https://github.com/weidai11/cryptopp/blob/master/misc.h#L506. And the function
(with extra noise omitted):

inline void memcpy_s(void *dest, size_t sizeInBytes, const void *src, size_t
count)
{
    if (count > sizeInBytes)
        throw InvalidArgument("memcpy_s: buffer overflow");

    if (src && dest)
        memcpy(dest, src, count);
}

I have not been able to reproduce this with a reproducer. The reproducer shown
below fails to tickle the issue.

Attached is the preprocessed source file with the problem, idea.ii.tar.gz.

==========

The reproducer shown below fails to reproduce the issue.

$ cat test.cxx
#include <cstddef>
#include <stdexcept>
#include <cstring>
#include <memory>

inline void
my_memcpy(void* dest, size_t sizeInBytes, const void* src, size_t count)
{
    if (count > sizeInBytes)
        throw std::runtime_error("Overflow");

    if(dest && src)
        memcpy(dest, src, count);
}

int main(int argc, char* argv[])
{
    char buf[16];
    my_memcpy(NULL, 16, argv[0], strlen(argv[0]));
    return 0;
}