public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug middle-end/95667] New: warning for memset writing across multiple members
@ 2020-06-13 23:36 msebor at gcc dot gnu.org
  2020-06-13 23:38 ` [Bug middle-end/95667] [11 Regression] unintended " msebor at gcc dot gnu.org
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: msebor at gcc dot gnu.org @ 2020-06-13 23:36 UTC (permalink / raw)
  To: gcc-bugs

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95667

            Bug ID: 95667
           Summary: warning for memset writing across multiple members
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: msebor at gcc dot gnu.org
  Target Milestone: ---

Although strictly correct, GCC usually avoids warning for calls to memcpy that
write into multiple members at the same time, up to the size of the complete
object.  This is done because the Linux kernel does these things in a few
places.  As dangerous as the practice is, the change committed to resolve
pr95353 (r11-1183) tried to preserve this behavior for now (in the future I'd
like to add a new warning option to control it), but the test case below shows
it didn't preserve the GCC 10 and prior behavior in this case (same with
memcpy).

$ cat z.c && gcc -O2 -S -Wall -Wextra -fdump-tree-optimized=/dev/stdout z.c
struct S { char a[3], b[5]; };

void* f (void)
{
  struct S *p = __builtin_malloc (sizeof *p);
  char s[] = "1234567";
  __builtin_strcpy (p->a, s);          // warning (good)
  return p;
}

void* g (void)
{
  struct S *p = __builtin_malloc (sizeof *p);
  __builtin_memset (p->a, 0, 8);       // warning not expected (yet)
  return p;
}
z.c: In function ‘f’:
z.c:7:3: warning: ‘__builtin_strcpy’ writing 8 bytes into a region of size 3
[-Wstringop-overflow=]
    7 |   __builtin_strcpy (p->a, s);          // warning (good)
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~
z.c:1:17: note: at offset 0 to object ‘a’ with size 3 declared here
    1 | struct S { char a[3], b[5]; };
      |                 ^

;; Function f (f, funcdef_no=0, decl_uid=1934, cgraph_uid=1, symbol_order=0)

f ()
{
  char s[8];
  struct S * p;
  long unsigned int _8;

  <bb 2> [local count: 1073741824]:
  p_4 = __builtin_malloc (8);
  s = "1234567";
  _8 = MEM <long unsigned int> [(char * {ref-all})&s];
  MEM <long unsigned int> [(char * {ref-all})p_4] = _8;
  s ={v} {CLOBBER};
  return p_4;

}



;; Function g (g, funcdef_no=1, decl_uid=1939, cgraph_uid=2, symbol_order=1)

g ()
{
  struct S * p;
  char[3] * _1;

  <bb 2> [local count: 1073741824]:
  p_4 = __builtin_malloc (8);
  _1 = &p_4->a;
  __builtin_memset (_1, 0, 8);
  return p_4;

}


z.c: In function ‘g’:
z.c:14:3: warning: ‘__builtin_memset’ writing 8 bytes into a region of size 3
overflows the destination [-Wstringop-overflow=]
   14 |   __builtin_memset (p->a, 0, 8);       // warning not expected (yet)
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
z.c:1:17: note: destination object ‘a’
    1 | struct S { char a[3], b[5]; };
      |                 ^

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-08-20 16:37 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-13 23:36 [Bug middle-end/95667] New: warning for memset writing across multiple members msebor at gcc dot gnu.org
2020-06-13 23:38 ` [Bug middle-end/95667] [11 Regression] unintended " msebor at gcc dot gnu.org
2020-06-15  6:49 ` rguenth at gcc dot gnu.org
2020-06-18 15:32 ` msebor at gcc dot gnu.org
2020-06-18 18:02 ` cvs-commit at gcc dot gnu.org
2020-08-20 16:37 ` msebor at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).