[Bug middle-end/96925] New: missing warning on sprintf into destination at negative offset

[Bug middle-end/96925] New: missing warning on sprintf into destination at negative offset

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96925

            Bug ID: 96925
           Summary: missing warning on sprintf into destination at
                    negative offset
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: msebor at gcc dot gnu.org
  Target Milestone: ---

Only the first of the two invalid calls below is diagnosed.  Both should be.

$ cat z.c && gcc -O2 -S -Wall -xc -fdump-tree-optimized=/dev/stdout z.c
extern char a[];

void f (int i)
{
  if (i >= 0) i = -1;
  __builtin_strcpy (a + i, "3");   // warning (good)
}

void g (int i)
{
  if (i >= 0) i = -1;
  __builtin_sprintf (a + i, "%i", 3);   // missing warning
}
z.c: In function ‘f’:
z.c:6:3: warning: ‘__builtin_memcpy’ offset [-2147483648, -1] is out of the
bounds of object ‘a’ with type ‘char[]’ [-Warray-bounds]
    6 |   __builtin_strcpy (a + i, "3");   // warning (good)
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
z.c:1:13: note: ‘a’ declared here
    1 | extern char a[];
      |             ^

;; Function f (f, funcdef_no=0, decl_uid=1931, cgraph_uid=1, symbol_order=0)

f (int i)
{
  sizetype _1;
  char * _2;

  <bb 2> [local count: 1073741824]:
  i_4 = MIN_EXPR <i_3(D), -1>;
  _1 = (sizetype) i_4;
  _2 = &a + _1;
  __builtin_memcpy (_2, "3", 2); [tail call]
  return;

}



;; Function g (g, funcdef_no=1, decl_uid=1934, cgraph_uid=2, symbol_order=1)

g (int i)
{
  sizetype _1;
  char * _2;

  <bb 2> [local count: 1073741824]:
  i_4 = MIN_EXPR <i_3(D), -1>;
  _1 = (sizetype) i_4;
  _2 = &a + _1;
  __builtin_sprintf (_2, "%i", 3); [tail call]
  return;

}

[Bug middle-end/96925] missing warning on sprintf into destination at negative offset

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96925

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |56456
           Keywords|                            |diagnostic

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
The warning for the strcpy is issued by the wrestrict pass which doesn't
consider sprintf.  -Wrestrict is implemented separately for sprintf but without
the same bounds checking.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56456
[Bug 56456] [meta-bug] bogus/missing -Warray-bounds