public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
From: "vmjuan90 at gmail dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c/99269] New: False positive -Wanalyzer-malloc-leak/-Wanalyzer-double-free with -fanalyzer
Date: Thu, 25 Feb 2021 13:55:44 +0000	[thread overview]
Message-ID: <bug-99269-4@http.gcc.gnu.org/bugzilla/> (raw)

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99269

            Bug ID: 99269
           Summary: False positive
                    -Wanalyzer-malloc-leak/-Wanalyzer-double-free with
                    -fanalyzer
           Product: gcc
           Version: 10.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: vmjuan90 at gmail dot com
  Target Milestone: ---

Created attachment 50255
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50255&action=edit
minimun example for reproduce

Hello

I added the minimun example file (bug.c) and the gcc command line for reproduce
what i think are 2 false positives from -fanalizer

$ gcc -v -save-temps -fanalyzer -c bug.c
Usando especificaciones internas.
COLLECT_GCC=gcc
Objetivo: x86_64-pc-linux-gnu
Configurado con:
/var/tmp/portage/sys-devel/gcc-10.2.0-r5/work/gcc-10.2.0/configure
--host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --prefix=/usr
--bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/10.2.0
--includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/include
--datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/10.2.0
--mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/10.2.0/man
--infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/10.2.0/info
--with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/include/g++-v10
--with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/10.2.0/python
--enable-languages=c,c++,fortran --enable-obsolete --enable-secureplt
--disable-werror --with-system-zlib --enable-nls --without-included-gettext
--enable-checking=release --with-bugurl=https://bugs.gentoo.org/
--with-pkgversion='Gentoo 10.2.0-r5 p6' --disable-esp --enable-libstdcxx-time
--with-build-config=bootstrap-lto --enable-shared --enable-threads=posix
--enable-__cxa_atexit --enable-clocale=gnu --enable-multilib
--with-multilib-list=m32,m64 --disable-fixed-point --enable-targets=all
--enable-libgomp --disable-libssp --disable-libada --disable-systemtap
--enable-vtable-verify --without-zstd --enable-lto --with-isl
--disable-isl-version-check --enable-default-pie --enable-default-ssp
Modelo de hilos: posix
Algoritmos de compresión LTO admitidos: zlib
gcc versión 10.2.0 (Gentoo 10.2.0-r5 p6)
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-fanalyzer' '-c' '-mtune=generic'
'-march=x86-64'
 /usr/libexec/gcc/x86_64-pc-linux-gnu/10.2.0/cc1 -E -quiet -v bug.c
-mtune=generic -march=x86-64 -fanalyzer -fpch-preprocess -o bug.i
se descarta el directorio inexistente "/usr/local/include"
se descarta el directorio inexistente
"/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../x86_64-pc-linux-gnu/include"
la búsqueda de #include "..." inicia aquí:
la búsqueda de #include <...> inicia aquí:
 /usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/include
 /usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/include-fixed
 /usr/include
Fin de la lista de búsqueda.
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-fanalyzer' '-c' '-mtune=generic'
'-march=x86-64'
 /usr/libexec/gcc/x86_64-pc-linux-gnu/10.2.0/cc1 -fpreprocessed bug.i -quiet
-dumpbase bug.c -mtune=generic -march=x86-64 -auxbase bug -version -fanalyzer
-o bug.s
GNU C17 (Gentoo 10.2.0-r5 p6) versión 10.2.0 (x86_64-pc-linux-gnu)
        compilado por GNU C versión 10.2.0, GMP versión 6.2.1, MPFR versión
4.1.0, MPC versión 1.2.1, isl versión isl-0.23-GMP

GGC heurísticas: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
GNU C17 (Gentoo 10.2.0-r5 p6) versión 10.2.0 (x86_64-pc-linux-gnu)
        compilado por GNU C versión 10.2.0, GMP versión 6.2.1, MPFR versión
4.1.0, MPC versión 1.2.1, isl versión isl-0.23-GMP

GGC heurísticas: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
Compiler executable checksum: 5fe470a537c6a646ee2db89927c9a5b2
En la función ‘example’:
bug.c:11:10: aviso: leak of ‘<desconocido>’ [CWE-401] [-Wanalyzer-malloc-leak]
   11 |  namelist[1] = malloc(sizeof **namelist);
      |          ^
  ‘example’: events 1-6
    |
    |    9 |  if (!namelist) return;
    |      |     ^
    |      |     |
    |      |     (1) following ‘false’ branch (when ‘namelist’ is non-NULL)...
    |   10 |  namelist[0] = malloc(sizeof **namelist);
    |      |                ~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                |
    |      |                (2) ...to here
    |      |                (3) allocated here
    |   11 |  namelist[1] = malloc(sizeof **namelist);
    |      |          ~
    |      |          |
    |      |          (6) ‘<desconocido>’ leaks here; was allocated at (3)
    |   12 |
    |   13 |  while(len--) { free(namelist[len]); }
    |      |       ~                      ~
    |      |       |                      |
    |      |       |                      (5) ...to here
    |      |       (4) following ‘true’ branch...
    |
bug.c:13:17: aviso: double-‘free’ of ‘<desconocido>’ [CWE-415]
[-Wanalyzer-double-free]
   13 |  while(len--) { free(namelist[len]); }
      |                 ^~~~~~~~~~~~~~~~~~~
  ‘example’: events 1-11
    |
    |    9 |  if (!namelist) return;
    |      |     ^
    |      |     |
    |      |     (1) following ‘false’ branch (when ‘namelist’ is non-NULL)...
    |   10 |  namelist[0] = malloc(sizeof **namelist);
    |      |                ~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                |
    |      |                (2) ...to here
    |......
    |   13 |  while(len--) { free(namelist[len]); }
    |      |       ~         ~~~~~~~~~~~~~~~~~~~
    |      |       |         |            |
    |      |       |         |            (4) ...to here
    |      |       |         |            (5) first ‘free’ here
    |      |       |         |            (7) ...to here
    |      |       |         |            (8) first ‘free’ here
    |      |       |         |            (10) ...to here
    |      |       |         (11) second ‘free’ here; first ‘free’ was at (8)
    |      |       (3) following ‘true’ branch...
    |      |       (6) following ‘true’ branch...
    |      |       (9) following ‘true’ branch...
    |
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-fanalyzer' '-c' '-mtune=generic'
'-march=x86-64'
 /usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../x86_64-pc-linux-gnu/bin/as
-v --64 -o bug.o bug.s
GNU ensamblador versión 2.34.0 (x86_64-pc-linux-gnu) utilizando BFD versión
(Gentoo 2.34 p6) 2.34.0
COMPILER_PATH=/usr/libexec/gcc/x86_64-pc-linux-gnu/10.2.0/:/usr/libexec/gcc/x86_64-pc-linux-gnu/10.2.0/:/usr/libexec/gcc/x86_64-pc-linux-gnu/:/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/:/usr/lib/gcc/x86_64-pc-linux-gnu/:/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../x86_64-pc-linux-gnu/bin/
LIBRARY_PATH=/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/:/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../lib64/:/lib/../lib64/:/usr/lib/../lib64/:/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../x86_64-pc-linux-gnu/lib/:/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/../../../:/lib/:/usr/lib/
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-fanalyzer' '-c' '-mtune=generic'
'-march=x86-64'

regards

             reply	other threads:[~2021-02-25 13:55 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-25 13:55 vmjuan90 at gmail dot com [this message]
2021-11-13  0:33 ` [Bug analyzer/99269] " npfhrotynz-ptnqh.myvf at noclue dot notk.org
2021-11-30 19:41 ` dmalcolm at gcc dot gnu.org
2021-11-30 22:50 ` cvs-commit at gcc dot gnu.org
2021-11-30 22:54 ` dmalcolm at gcc dot gnu.org

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=bug-99269-4@http.gcc.gnu.org/bugzilla/ \
    --to=gcc-bugzilla@gcc.gnu.org \
    --cc=gcc-bugs@gcc.gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).