public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/95043] New: GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);'
@ 2020-05-10 23:09 noloader at gmail dot com
2020-05-11 7:30 ` [Bug analyzer/95043] " marxin at gcc dot gnu.org
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: noloader at gmail dot com @ 2020-05-10 23:09 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95043
Bug ID: 95043
Summary: GCC 10 Analyzer and false positive on 'memcpy(dest,
src, count);'
Product: gcc
Version: 10.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: noloader at gmail dot com
Target Milestone: ---
Created attachment 48500
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48500&action=edit
Preprocessed source file idea.ii
Hi Everyone,
I'm trying out the analyzer on a C++ project. I'm working on Fedora 32 with GCC
10.
$ gcc --version
gcc (GCC) 10.0.1 20200430 (Red Hat 10.0.1-0.14)
Here's what I am seeing:
| 527 | if (src && dest)
| | ~~
| | |
| | (9) ...to here
| | (10) following ‘true’ branch...
| 528 | memcpy(dest, src, count);
| | ~~~~~~~~~~~~~~~~~~~~~~~~
| | | |
| | | (12) argument 1 (‘dest’) NULL where non-null expected
Here's the source file:
https://github.com/weidai11/cryptopp/blob/master/misc.h#L506. And the function
(with extra noise omitted):
inline void memcpy_s(void *dest, size_t sizeInBytes, const void *src, size_t
count)
{
if (count > sizeInBytes)
throw InvalidArgument("memcpy_s: buffer overflow");
if (src && dest)
memcpy(dest, src, count);
}
I have not been able to reproduce this with a reproducer. The reproducer shown
below fails to tickle the issue.
Attached is the preprocessed source file with the problem, idea.ii.tar.gz.
==========
The reproducer shown below fails to reproduce the issue.
$ cat test.cxx
#include <cstddef>
#include <stdexcept>
#include <cstring>
#include <memory>
inline void
my_memcpy(void* dest, size_t sizeInBytes, const void* src, size_t count)
{
if (count > sizeInBytes)
throw std::runtime_error("Overflow");
if(dest && src)
memcpy(dest, src, count);
}
int main(int argc, char* argv[])
{
char buf[16];
my_memcpy(NULL, 16, argv[0], strlen(argv[0]));
return 0;
}
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug analyzer/95043] GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);'
2020-05-10 23:09 [Bug analyzer/95043] New: GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);' noloader at gmail dot com
@ 2020-05-11 7:30 ` marxin at gcc dot gnu.org
2020-05-11 16:29 ` dmalcolm at gcc dot gnu.org
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: marxin at gcc dot gnu.org @ 2020-05-11 7:30 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95043
Martin Liška <marxin at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |ASSIGNED
Last reconfirmed| |2020-05-11
Ever confirmed|0 |1
CC| |marxin at gcc dot gnu.org
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug analyzer/95043] GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);'
2020-05-10 23:09 [Bug analyzer/95043] New: GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);' noloader at gmail dot com
2020-05-11 7:30 ` [Bug analyzer/95043] " marxin at gcc dot gnu.org
@ 2020-05-11 16:29 ` dmalcolm at gcc dot gnu.org
2021-03-02 21:49 ` dmalcolm at gcc dot gnu.org
2021-03-24 21:08 ` dmalcolm at gcc dot gnu.org
3 siblings, 0 replies; 5+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2020-05-11 16:29 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95043
--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Please note that C++ isn't supported in the GCC 10 implementation of -fanalyzer
(I hope to do so for GCC 11, but there's a lot of work to do).
In particular, I haven't implemented exceptions yet.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug analyzer/95043] GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);'
2020-05-10 23:09 [Bug analyzer/95043] New: GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);' noloader at gmail dot com
2020-05-11 7:30 ` [Bug analyzer/95043] " marxin at gcc dot gnu.org
2020-05-11 16:29 ` dmalcolm at gcc dot gnu.org
@ 2021-03-02 21:49 ` dmalcolm at gcc dot gnu.org
2021-03-24 21:08 ` dmalcolm at gcc dot gnu.org
3 siblings, 0 replies; 5+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2021-03-02 21:49 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95043
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |UNCONFIRMED
Ever confirmed|1 |0
--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
I can reproduce a warning with the preprocessed source with gcc 10 at -O1 and
above; stripping out the line-markers with:
perl -pi -e 's/^#.*\n//g;' idea.ii
I get:
https://godbolt.org/z/qxehzM
which shows a diagnostic, where (I think) m_array is NULL from
m_fallbackAllocator.allocate, which looks like a valid warning.
With gcc 11, -Wanalyzer-too-complex shows that the analyzer is hitting the
complexity limit and bailing out, without emitting the diagnostic.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug analyzer/95043] GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);'
2020-05-10 23:09 [Bug analyzer/95043] New: GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);' noloader at gmail dot com
` (2 preceding siblings ...)
2021-03-02 21:49 ` dmalcolm at gcc dot gnu.org
@ 2021-03-24 21:08 ` dmalcolm at gcc dot gnu.org
3 siblings, 0 replies; 5+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2021-03-24 21:08 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95043
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |WORKSFORME
--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
I'm not able to reproduce this with gcc 11, and I wasn't able to reduce the gcc
10 reproducer. Perhaps fixed by the big state rewrite of gcc 11 (although C++
is still not supported by -fanalyzer, sorry).
Closing this out as "WORKSFORME"; feel free to reopen if you're able to
reproduce with gcc 11.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-03-24 21:08 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-10 23:09 [Bug analyzer/95043] New: GCC 10 Analyzer and false positive on 'memcpy(dest, src, count);' noloader at gmail dot com
2020-05-11 7:30 ` [Bug analyzer/95043] " marxin at gcc dot gnu.org
2020-05-11 16:29 ` dmalcolm at gcc dot gnu.org
2021-03-02 21:49 ` dmalcolm at gcc dot gnu.org
2021-03-24 21:08 ` dmalcolm at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).