[Bug analyzer/97072] New: -Wanalyzer-malloc-leak false positive when writing through some pointers

[Bug analyzer/97072] New: -Wanalyzer-malloc-leak false positive when writing through some pointers

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97072

            Bug ID: 97072
           Summary: -Wanalyzer-malloc-leak false positive when writing
                    through some pointers
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
  Target Milestone: ---

Initially seen when writing through an unknown_svalue pointer; this reproducer
captures similar behavior, albeit with a conjured_svalue pointer:

#include <stdlib.h>

void unknown_fn_1 (void *);

void test_1 (int co, int y)
{
  void *p = malloc (1024);
  void **q;
  unknown_fn_1 (&q);
  *q = p;
}

t.c: In function ‘test_1’:
t.c:11:1: warning: leak of ‘p’ [CWE-401] [-Wanalyzer-malloc-leak]
   11 | }
      | ^
  ‘test_1’: events 1-2
    |
    |    7 |   void *p = malloc (1024);
    |      |             ^~~~~~~~~~~~~
    |      |             |
    |      |             (1) allocated here
    |......
    |   11 | }
    |      | ~            
    |      | |
    |      | (2) ‘p’ leaks here; was allocated at (1)
    |

https://godbolt.org/z/WcMWda

The leak warning is a false positive, as p was written to *q.

[Bug analyzer/97072] -Wanalyzer-malloc-leak false positive when writing through some pointers

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97072

--- Comment #1 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:ac3966e315ada63eb379d560a012fa77c3909155

commit r11-6497-gac3966e315ada63eb379d560a012fa77c3909155
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Tue Jan 5 20:54:50 2021 -0500

    analyzer: fix false leaks when writing through unknown ptrs [PR97072]

    gcc/analyzer/ChangeLog:
            PR analyzer/97072
            * region-model-reachability.cc (reachable_regions::init_cluster):
            Convert symbolic region handling to a switch statement.  Add cases
            to handle SK_UNKNOWN and SK_CONJURED.

    gcc/testsuite/ChangeLog:
            PR analyzer/97072
            * gcc.dg/analyzer/pr97072.c: New test.

[Bug analyzer/97072] -Wanalyzer-malloc-leak false positive when writing through some pointers

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97072

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above commit.