[Bug analyzer/99028] New: diagnostic path is too verbose

[Bug analyzer/99028] New: diagnostic path is too verbose

[antonio.chirizzi at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99028

            Bug ID: 99028
           Summary: diagnostic path is too verbose
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: antonio.chirizzi at gmail dot com
  Target Milestone: ---

Created attachment 50151
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50151&action=edit
Tar.gz file which contains the path.c file (from the git source code repo)

When analysing a path for a possible null dereference, in the straight forward
case, there should be no need to show the verbose description of how it can
lead to a null dereference.

Take this case where a call to malloc is followed by the usage of the returned
pointer:

In function ‘add_to_trie’:
path.c:175:28: warning: dereference of possibly-NULL ‘child’ [CWE-690]
[-Wanalyzer-possible-null-dereference]
  175 |                 child->len = root->len - i - 1;
      |                 ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~
  ‘add_to_trie’: events 1-8
    |
    |  157 |         if (!*key) {
    |      |            ^
    |      |            |
    |      |            (1) following ‘false’ branch...
    |......
    |  164 |         for (i = 0; i < root->len; i++) {
    |      |              ~~~~~  ~~~~~~~~~~~~~
    |      |                |      |
    |      |                |      (3) following ‘true’ branch...
    |      |                (2) ...to here
    |  165 |                 if (root->contents[i] == key[i])
    |      |                    ~~~~~~~~~~~~~~~
    |      |                    |    |
    |      |                    |    (4) ...to here
    |      |                    (5) following ‘false’ branch...
    |......
    |  172 |                 child = malloc(sizeof(*child));
    |      |                         ~~~~~~~~~~~~~~~~~~~~~~
    |      |                         |
    |      |                         (6) ...to here
    |      |                         (7) this call could return NULL
    |......
    |  175 |                 child->len = root->len - i - 1;
    |      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                            |
    |      |                            (8) ‘child’ could be NULL: unchecked
value from (7)
    |


I am attaching the source code which demonstrates this.

Use only "gcc -fanalyzer -c path.c"

[Bug analyzer/99028] diagnostic path is too verbose

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99028

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2021-02-09

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks Antonio; I can successfully reproduce the issue with the attachment.

I agree that the path is overly verbose.  It should only show events (7) and
(8).

[Bug analyzer/99028] diagnostic path is too verbose

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99028

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
At -fanalyzer-verbosity=1 and below, we only show those two events:

In function ‘add_to_trie’:
../../src/gcc/testsuite/gcc.dg/analyzer/pr99028.c:175:28: warning: dereference
of possibly-NULL ‘child’ [CWE-690] [-Wanalyzer-possible-null-dereference]
  175 |                 child->len = root->len - i - 1;
      |                 ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~
  ‘add_to_trie’: events 1-2
    |
    |  172 |                 child = malloc(sizeof(*child));
    |      |                         ^~~~~~~~~~~~~~~~~~~~~~
    |      |                         |
    |      |                         (1) this call could return NULL
    |......
    |  175 |                 child->len = root->len - i - 1;
    |      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                            |
    |      |                            (2) ‘child’ could be NULL: unchecked
value from (1)
    |

The default is -fanalyzer-verbosity=2.

It seems some tweaking is needed.