[Bug middle-end/95667] New: warning for memset writing across multiple members

[Bug middle-end/95667] New: warning for memset writing across multiple members

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95667

            Bug ID: 95667
           Summary: warning for memset writing across multiple members
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: msebor at gcc dot gnu.org
  Target Milestone: ---

Although strictly correct, GCC usually avoids warning for calls to memcpy that
write into multiple members at the same time, up to the size of the complete
object.  This is done because the Linux kernel does these things in a few
places.  As dangerous as the practice is, the change committed to resolve
pr95353 (r11-1183) tried to preserve this behavior for now (in the future I'd
like to add a new warning option to control it), but the test case below shows
it didn't preserve the GCC 10 and prior behavior in this case (same with
memcpy).

$ cat z.c && gcc -O2 -S -Wall -Wextra -fdump-tree-optimized=/dev/stdout z.c
struct S { char a[3], b[5]; };

void* f (void)
{
  struct S *p = __builtin_malloc (sizeof *p);
  char s[] = "1234567";
  __builtin_strcpy (p->a, s);          // warning (good)
  return p;
}

void* g (void)
{
  struct S *p = __builtin_malloc (sizeof *p);
  __builtin_memset (p->a, 0, 8);       // warning not expected (yet)
  return p;
}
z.c: In function ‘f’:
z.c:7:3: warning: ‘__builtin_strcpy’ writing 8 bytes into a region of size 3
[-Wstringop-overflow=]
    7 |   __builtin_strcpy (p->a, s);          // warning (good)
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~
z.c:1:17: note: at offset 0 to object ‘a’ with size 3 declared here
    1 | struct S { char a[3], b[5]; };
      |                 ^

;; Function f (f, funcdef_no=0, decl_uid=1934, cgraph_uid=1, symbol_order=0)

f ()
{
  char s[8];
  struct S * p;
  long unsigned int _8;

  <bb 2> [local count: 1073741824]:
  p_4 = __builtin_malloc (8);
  s = "1234567";
  _8 = MEM <long unsigned int> [(char * {ref-all})&s];
  MEM <long unsigned int> [(char * {ref-all})p_4] = _8;
  s ={v} {CLOBBER};
  return p_4;

}



;; Function g (g, funcdef_no=1, decl_uid=1939, cgraph_uid=2, symbol_order=1)

g ()
{
  struct S * p;
  char[3] * _1;

  <bb 2> [local count: 1073741824]:
  p_4 = __builtin_malloc (8);
  _1 = &p_4->a;
  __builtin_memset (_1, 0, 8);
  return p_4;

}


z.c: In function ‘g’:
z.c:14:3: warning: ‘__builtin_memset’ writing 8 bytes into a region of size 3
overflows the destination [-Wstringop-overflow=]
   14 |   __builtin_memset (p->a, 0, 8);       // warning not expected (yet)
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
z.c:1:17: note: destination object ‘a’
    1 | struct S { char a[3], b[5]; };
      |                 ^

[Bug middle-end/95667] [11 Regression] unintended warning for memset writing across multiple members

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95667

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2020-06-13
             Blocks|                            |88443
           Assignee|unassigned at gcc dot gnu.org      |msebor at gcc dot gnu.org
           Keywords|                            |diagnostic
     Ever confirmed|0                           |1
            Summary|warning for memset writing  |[11 Regression] unintended
                   |across multiple members     |warning for memset writing
                   |                            |across multiple members

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
See https://gcc.gnu.org/pipermail/gcc-patches/2020-June/548040.html for the
original report.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88443
[Bug 88443] [meta-bug] bogus/missing -Wstringop-overflow warnings

[Bug middle-end/95667] [11 Regression] unintended warning for memset writing across multiple members

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95667

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |11.0
            Version|10.0                        |11.0

[Bug middle-end/95667] [11 Regression] unintended warning for memset writing across multiple members

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95667

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch

--- Comment #2 from Martin Sebor <msebor at gcc dot gnu.org> ---
Patch: https://gcc.gnu.org/pipermail/gcc-patches/2020-June/548511.html

[Bug middle-end/95667] [11 Regression] unintended warning for memset writing across multiple members

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95667

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:5acc654e380797bbf402bc3a0a67f9a6ac4c2a83

commit r11-1517-g5acc654e380797bbf402bc3a0a67f9a6ac4c2a83
Author: Martin Sebor <msebor@redhat.com>
Date:   Thu Jun 18 12:00:36 2020 -0600

    Avoid warning for memset writing over multiple members.

    Resolves:
    PR middle-end/95667 - unintended warning for memset writing across multiple
members
    PR middle-end/92814 - missing -Wstringop-overflow writing into a
dynamically allocated flexible array member

    gcc/ChangeLog:

            PR middle-end/95667
            PR middle-end/92814
            * builtins.c (compute_objsize): Remove call to
            compute_builtin_object_size and instead compute conservative sizes
            directly here.

    gcc/testsuite/ChangeLog:

            PR middle-end/95667
            PR middle-end/92814
            * gcc.dg/Wstringop-overflow-25.c: Remove xfails.
            * gcc.dg/Wstringop-overflow-39.c: New test.

[Bug middle-end/95667] [11 Regression] unintended warning for memset writing across multiple members

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95667

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> ---
Fixed in r11-1517.