[Bug c/99196] New: GCC analyzer doesn't know that error (code != 0, ...) exits the program

[Bug c/99196] New: GCC analyzer doesn't know that error (code != 0, ...) exits the program

[rjones at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99196

            Bug ID: 99196
           Summary: GCC analyzer doesn't know that error (code != 0, ...)
                    exits the program
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: rjones at redhat dot com
  Target Milestone: ---

https://github.com/libguestfs/libguestfs/blob/f19fd566f6387ce7e4d82409528c9dde374d25e0/daemon/tar.c#L108

tar.c: In function 'read_error_file':
tar.c:113:11: error: use of NULL 'str' where non-null expected [CWE-476]
[-Werror=analyzer-null-argument]
  113 |     len = strlen (str);
      |           ^~~~~~~~~~~~
  'read_error_file': events 1-7
    |
    |  109 |   if (str == NULL) {
    |      |      ^
    |      |      |
    |      |      (1) following 'true' branch (when 'str' is NULL)...
    |  110 |     str = strdup ("(no error)");
    |      |     ~~~   ~~~~~~~~~~~~~~~~~~~~~
    |      |     |     |
    |      |     |     (3) allocated here
    |      |     (2) ...to here
    |  111 |     if (str == NULL)
    |      |        ~
    |      |        |
    |      |        (4) assuming 'str' is NULL
    |      |        (5) following 'true' branch (when 'str' is NULL)...
    |  112 |       error (EXIT_FAILURE, errno, "strdup"); /* XXX */
    |      |       ~~~~~
    |      |       |
    |      |       (6) ...to here
    |  113 |     len = strlen (str);
    |      |           ~~~~~~~~~~~~
    |      |           |
    |      |           (7) argument 1 ('str') NULL where non-null expected
    |
In file included from ../gnulib/lib/string.h:41,
                 from tar.c:23:
/usr/include/string.h:391:15: note: argument 1 of 'strlen' must be non-null
  391 | extern size_t strlen (const char *__s)
      |               ^~~~~~
cc1: all warnings being treated as errors

In the original code if str == NULL, error (EXIT_FAILURE, ...) is
called which exits the program.  Therefore strlen (NULL) cannot
be called so the warning is bogus.

https://www.man7.org/linux/man-pages/man3/error.3.html

       "If status has a nonzero value, then error() calls exit(3) to
       terminate the program using the given value as the exit status."

gcc-11.0.0-0.19.fc35.x86_64

[Bug analyzer/99196] GCC analyzer doesn't know that error (code != 0, ...) exits the program

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99196

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |msebor at gcc dot gnu.org
          Component|c                           |analyzer
           Assignee|unassigned at gcc dot gnu.org      |dmalcolm at gcc dot gnu.org

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
Reassigning to analyzer.

[Bug analyzer/99196] GCC analyzer doesn't know that error (code != 0, ...) exits the program

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99196

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-02-22
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this; confirmed.  I'm working on a fix.

[Bug analyzer/99196] GCC analyzer doesn't know that error (code != 0, ...) exits the program

[rjones at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99196

--- Comment #3 from Richard W.M. Jones <rjones at redhat dot com> ---
Note if errcode == 0 then error does NOT exit :-)

[Bug analyzer/99196] GCC analyzer doesn't know that error (code != 0, ...) exits the program

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99196

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:5ee4ba031dd9fc60bf2494ca30f46c0acaa34805

commit r11-7333-g5ee4ba031dd9fc60bf2494ca30f46c0acaa34805
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Feb 22 18:46:05 2021 -0500

    analyzer: handle error/error_at_line [PR99196]

    PR analyzer/99196 describes a false positive from -fanalyzer due to
    the analyzer not "knowing" that calls to GNU libc's error(3) with a
    nonzero status terminate the process and thus don't return.

    This patch fixes the false positive by special-casing "error" and
    "error_at_line".

    gcc/analyzer/ChangeLog:
            PR analyzer/99196
            * engine.cc (exploded_node::on_stmt): Provide terminate_path
            flag as a way for on_call_pre to terminate the current analysis
            path.
            * region-model-impl-calls.cc (call_details::num_args): New.
            (region_model::impl_call_error): New.
            * region-model.cc (region_model::on_call_pre): Add param
            "out_terminate_path".  Handle "error" and "error_at_line".
            * region-model.h (call_details::num_args): New decl.
            (region_model::on_call_pre): Add param "out_terminate_path".
            (region_model::impl_call_error): New decl.

    gcc/testsuite/ChangeLog:
            PR analyzer/99196
            * gcc.dg/analyzer/error-1.c: New test.
            * gcc.dg/analyzer/error-2.c: New test.
            * gcc.dg/analyzer/error-3.c: New test.

[Bug analyzer/99196] GCC analyzer doesn't know that error (code != 0, ...) exits the program

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99196

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #5 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above commit