[Bug c/99269] New: False positive -Wanalyzer-malloc-leak/-Wanalyzer-double-free with -fanalyzer

[Bug c/99269] New: False positive -Wanalyzer-malloc-leak/-Wanalyzer-double-free with -fanalyzer

[vmjuan90 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99269

            Bug ID: 99269
           Summary: False positive
                    -Wanalyzer-malloc-leak/-Wanalyzer-double-free with
                    -fanalyzer
           Product: gcc
           Version: 10.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: vmjuan90 at gmail dot com
  Target Milestone: ---

Created attachment 50255
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50255&action=edit
minimun example for reproduce

Hello

I added the minimun example file (bug.c) and the gcc command line for reproduce
what i think are 2 false positives from -fanalizer

$ gcc -v -save-temps -fanalyzer -c bug.c
Usando especificaciones internas.
COLLECT_GCC=gcc
Objetivo: x86_64-pc-linux-gnu
Configurado con:
/var/tmp/portage/sys-devel/gcc-10.2.0-r5/work/gcc-10.2.0/configure
--host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --prefix=/usr
--bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/10.2.0
--includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/include
--datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/10.2.0
--mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/10.2.0/man
--infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/10.2.0/info
--with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/include/g++-v10
--with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/10.2.0/python
--enable-languages=c,c++,fortran --enable-obsolete --enable-secureplt
--disable-werror --with-system-zlib --enable-nls --without-included-gettext
--enable-checking=release --with-bugurl=https://bugs.gentoo.org/
--with-pkgversion='Gentoo 10.2.0-r5 p6' --disable-esp --enable-libstdcxx-time
--with-build-config=bootstrap-lto --enable-shared --enable-threads=posix
--enable-__cxa_atexit --enable-clocale=gnu --enable-multilib
--with-multilib-list=m32,m64 --disable-fixed-point --enable-targets=all
--enable-libgomp --disable-libssp --disable-libada --disable-systemtap
--enable-vtable-verify --without-zstd --enable-lto --with-isl
--disable-isl-version-check --enable-default-pie --enable-default-ssp
Modelo de hilos: posix
Algoritmos de compresión LTO admitidos: zlib
gcc versión 10.2.0 (Gentoo 10.2.0-r5 p6)
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-fanalyzer' '-c' '-mtune=generic'
'-march=x86-64'
 /usr/libexec/gcc/x86_64-pc-linux-gnu/10.2.0/cc1 -E -quiet -v bug.c
-mtune=generic -march=x86-64 -fanalyzer -fpch-preprocess -o bug.i
se descarta el directorio inexistente "/usr/local/include"
se descarta el directorio inexistente
"/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../x86_64-pc-linux-gnu/include"
la búsqueda de #include "..." inicia aquí:
la búsqueda de #include <...> inicia aquí:
 /usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/include
 /usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/include-fixed
 /usr/include
Fin de la lista de búsqueda.
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-fanalyzer' '-c' '-mtune=generic'
'-march=x86-64'
 /usr/libexec/gcc/x86_64-pc-linux-gnu/10.2.0/cc1 -fpreprocessed bug.i -quiet
-dumpbase bug.c -mtune=generic -march=x86-64 -auxbase bug -version -fanalyzer
-o bug.s
GNU C17 (Gentoo 10.2.0-r5 p6) versión 10.2.0 (x86_64-pc-linux-gnu)
        compilado por GNU C versión 10.2.0, GMP versión 6.2.1, MPFR versión
4.1.0, MPC versión 1.2.1, isl versión isl-0.23-GMP

GGC heurísticas: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
GNU C17 (Gentoo 10.2.0-r5 p6) versión 10.2.0 (x86_64-pc-linux-gnu)
        compilado por GNU C versión 10.2.0, GMP versión 6.2.1, MPFR versión
4.1.0, MPC versión 1.2.1, isl versión isl-0.23-GMP

GGC heurísticas: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
Compiler executable checksum: 5fe470a537c6a646ee2db89927c9a5b2
En la función ‘example’:
bug.c:11:10: aviso: leak of ‘<desconocido>’ [CWE-401] [-Wanalyzer-malloc-leak]
   11 |  namelist[1] = malloc(sizeof **namelist);
      |          ^
  ‘example’: events 1-6
    |
    |    9 |  if (!namelist) return;
    |      |     ^
    |      |     |
    |      |     (1) following ‘false’ branch (when ‘namelist’ is non-NULL)...
    |   10 |  namelist[0] = malloc(sizeof **namelist);
    |      |                ~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                |
    |      |                (2) ...to here
    |      |                (3) allocated here
    |   11 |  namelist[1] = malloc(sizeof **namelist);
    |      |          ~
    |      |          |
    |      |          (6) ‘<desconocido>’ leaks here; was allocated at (3)
    |   12 |
    |   13 |  while(len--) { free(namelist[len]); }
    |      |       ~                      ~
    |      |       |                      |
    |      |       |                      (5) ...to here
    |      |       (4) following ‘true’ branch...
    |
bug.c:13:17: aviso: double-‘free’ of ‘<desconocido>’ [CWE-415]
[-Wanalyzer-double-free]
   13 |  while(len--) { free(namelist[len]); }
      |                 ^~~~~~~~~~~~~~~~~~~
  ‘example’: events 1-11
    |
    |    9 |  if (!namelist) return;
    |      |     ^
    |      |     |
    |      |     (1) following ‘false’ branch (when ‘namelist’ is non-NULL)...
    |   10 |  namelist[0] = malloc(sizeof **namelist);
    |      |                ~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                |
    |      |                (2) ...to here
    |......
    |   13 |  while(len--) { free(namelist[len]); }
    |      |       ~         ~~~~~~~~~~~~~~~~~~~
    |      |       |         |            |
    |      |       |         |            (4) ...to here
    |      |       |         |            (5) first ‘free’ here
    |      |       |         |            (7) ...to here
    |      |       |         |            (8) first ‘free’ here
    |      |       |         |            (10) ...to here
    |      |       |         (11) second ‘free’ here; first ‘free’ was at (8)
    |      |       (3) following ‘true’ branch...
    |      |       (6) following ‘true’ branch...
    |      |       (9) following ‘true’ branch...
    |
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-fanalyzer' '-c' '-mtune=generic'
'-march=x86-64'
 /usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../x86_64-pc-linux-gnu/bin/as
-v --64 -o bug.o bug.s
GNU ensamblador versión 2.34.0 (x86_64-pc-linux-gnu) utilizando BFD versión
(Gentoo 2.34 p6) 2.34.0
COMPILER_PATH=/usr/libexec/gcc/x86_64-pc-linux-gnu/10.2.0/:/usr/libexec/gcc/x86_64-pc-linux-gnu/10.2.0/:/usr/libexec/gcc/x86_64-pc-linux-gnu/:/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/:/usr/lib/gcc/x86_64-pc-linux-gnu/:/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../x86_64-pc-linux-gnu/bin/
LIBRARY_PATH=/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/:/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../lib64/:/lib/../lib64/:/usr/lib/../lib64/:/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../x86_64-pc-linux-gnu/lib/:/usr/lib/gcc/x86_64-pc-linux-gnu/10.2.0/../../../:/lib/:/usr/lib/
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-fanalyzer' '-c' '-mtune=generic'
'-march=x86-64'

regards

[Bug analyzer/99269] False positive -Wanalyzer-malloc-leak/-Wanalyzer-double-free with -fanalyzer

[npfhrotynz-ptnqh.myvf at noclue dot notk.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99269

Dominique Martinet <npfhrotynz-ptnqh.myvf at noclue dot notk.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |npfhrotynz-ptnqh.myvf@noclu
                   |                            |e.notk.org

--- Comment #1 from Dominique Martinet <npfhrotynz-ptnqh.myvf at noclue dot notk.org> ---
gcc 11.2.1 20210728 (fc34) does not produce any warning with this, so would be
tempted to say it's been fixed.

[Bug analyzer/99269] False positive -Wanalyzer-malloc-leak/-Wanalyzer-double-free with -fanalyzer

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99269

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2021-11-30
     Ever confirmed|0                           |1

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug.

I'm able to reproduce it with gcc 10.3:
  https://godbolt.org/z/xajnz8abn
but it seems to be fixed in gcc 11 onwards (I heavily rewrote the internals of
the analyzer in gcc 11).

I'll add this as a regression test to the testsuite and then close this out;
thanks again.

[Bug analyzer/99269] False positive -Wanalyzer-malloc-leak/-Wanalyzer-double-free with -fanalyzer

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99269

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:9603bccba62e250d0ff64863a1730a167d571a25

commit r12-5641-g9603bccba62e250d0ff64863a1730a167d571a25
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Tue Nov 30 14:47:24 2021 -0500

    analyzer: add regression test [PR99269]

    gcc/testsuite/ChangeLog:
            PR analyzer/99269
            * gcc.dg/analyzer/pr99269.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/99269] False positive -Wanalyzer-malloc-leak/-Wanalyzer-double-free with -fanalyzer

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99269

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Fixed in GCC 11; test coverage added by above commit to GCC 12 onwards.