[Bug middle-end/95667] New: warning for memset writing across multiple members

["msebor at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95667

            Bug ID: 95667
           Summary: warning for memset writing across multiple members
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: msebor at gcc dot gnu.org
  Target Milestone: ---

Although strictly correct, GCC usually avoids warning for calls to memcpy that
write into multiple members at the same time, up to the size of the complete
object.  This is done because the Linux kernel does these things in a few
places.  As dangerous as the practice is, the change committed to resolve
pr95353 (r11-1183) tried to preserve this behavior for now (in the future I'd
like to add a new warning option to control it), but the test case below shows
it didn't preserve the GCC 10 and prior behavior in this case (same with
memcpy).

$ cat z.c && gcc -O2 -S -Wall -Wextra -fdump-tree-optimized=/dev/stdout z.c
struct S { char a[3], b[5]; };

void* f (void)
{
  struct S *p = __builtin_malloc (sizeof *p);
  char s[] = "1234567";
  __builtin_strcpy (p->a, s);          // warning (good)
  return p;
}

void* g (void)
{
  struct S *p = __builtin_malloc (sizeof *p);
  __builtin_memset (p->a, 0, 8);       // warning not expected (yet)
  return p;
}
z.c: In function ‘f’:
z.c:7:3: warning: ‘__builtin_strcpy’ writing 8 bytes into a region of size 3
[-Wstringop-overflow=]
    7 |   __builtin_strcpy (p->a, s);          // warning (good)
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~
z.c:1:17: note: at offset 0 to object ‘a’ with size 3 declared here
    1 | struct S { char a[3], b[5]; };
      |                 ^

;; Function f (f, funcdef_no=0, decl_uid=1934, cgraph_uid=1, symbol_order=0)

f ()
{
  char s[8];
  struct S * p;
  long unsigned int _8;

  <bb 2> [local count: 1073741824]:
  p_4 = __builtin_malloc (8);
  s = "1234567";
  _8 = MEM <long unsigned int> [(char * {ref-all})&s];
  MEM <long unsigned int> [(char * {ref-all})p_4] = _8;
  s ={v} {CLOBBER};
  return p_4;

}



;; Function g (g, funcdef_no=1, decl_uid=1939, cgraph_uid=2, symbol_order=1)

g ()
{
  struct S * p;
  char[3] * _1;

  <bb 2> [local count: 1073741824]:
  p_4 = __builtin_malloc (8);
  _1 = &p_4->a;
  __builtin_memset (_1, 0, 8);
  return p_4;

}


z.c: In function ‘g’:
z.c:14:3: warning: ‘__builtin_memset’ writing 8 bytes into a region of size 3
overflows the destination [-Wstringop-overflow=]
   14 |   __builtin_memset (p->a, 0, 8);       // warning not expected (yet)
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
z.c:1:17: note: destination object ‘a’
    1 | struct S { char a[3], b[5]; };
      |                 ^