[Bug analyzer/97074] New: -Wanalyzer-malloc-leak false positive when merging states

[Bug analyzer/97074] New: -Wanalyzer-malloc-leak false positive when merging states

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97074

            Bug ID: 97074
           Summary: -Wanalyzer-malloc-leak false positive when merging
                    states
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
  Target Milestone: ---

https://godbolt.org/z/5P3T8E

#include <stdlib.h>

void *x, *y;

void test_1 (int flag)
{
  void *p = malloc (1024);
  if (flag)
    x = p;
  else
    y = p;
  __analyzer_dump ();
}

Has this false leak report:

t.c:13:1: warning: leak of ‘p’ [CWE-401] [-Wanalyzer-malloc-leak]
   13 | }
      | ^
  ‘test_1’: events 1-2
    |
    |    7 |   void *p = malloc (1024);
    |      |             ^~~~~~~~~~~~~
    |      |             |
    |      |             (1) allocated here
    |......
    |   13 | }
    |      | ~            
    |      | |
    |      | (2) ‘p’ leaks here; was allocated at (1)
    |

__analyzer_dump shows that state merging leads to a merger of the x and y
values to unknown at the join-point:

rmodel:
stack depth: 1
  frame (index 0): frame: ‘test_1’@1
clusters within ::
  cluster for: x: UNKNOWN(void *)
  cluster for: y: UNKNOWN(void *)
clusters within frame: ‘test_1’@1
  cluster for: p_4: &HEAP_ALLOCATED_REGION(8)
m_called_unknown_fn: FALSE
constraint_manager:
  equiv classes:
  constraints:
malloc: 
  global: start
  0x3d10590: &HEAP_ALLOCATED_REGION(8): unchecked (malloc) (‘p_4’)

[Bug analyzer/97074] -Wanalyzer-malloc-leak false positive when merging states

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97074

--- Comment #1 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:be6c485b24f2b47ac85380dd2bea025d353f1f91

commit r11-6513-gbe6c485b24f2b47ac85380dd2bea025d353f1f91
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Wed Jan 6 21:44:07 2021 -0500

    analyzer: fix false leak reports when merging states [PR97074]

    gcc/analyzer/ChangeLog:
            PR analyzer/97074
            * store.cc (binding_cluster::can_merge_p): Add "out_store" param
            and pass to calls to binding_cluster::make_unknown_relative_to.
            (binding_cluster::make_unknown_relative_to): Add "out_store"
            param.  Use it to mark base regions that are pointed to by
            pointers that become unknown as having escaped.
            (store::can_merge_p): Pass out_store to
            binding_cluster::can_merge_p.
            * store.h (binding_cluster::can_merge_p): Add "out_store" param.
            (binding_cluster::make_unknown_relative_to): Likewise.
            * svalue.cc (region_svalue::implicitly_live_p): New vfunc.
            * svalue.h (region_svalue::implicitly_live_p): New vfunc decl.

    gcc/testsuite/ChangeLog:
            PR analyzer/97074
            * gcc.dg/analyzer/pr97074.c: New test.

[Bug analyzer/97074] -Wanalyzer-malloc-leak false positive when merging states

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97074

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above commit.