public inbox for gcc-cvs@sourceware.org help / color / mirror / Atom feed
From: Jakub Jelinek <jakub@gcc.gnu.org> To: gcc-cvs@gcc.gnu.org Subject: [gcc r9-9408] c++: Fix up ubsan false positives on references [PR95693] Date: Tue, 20 Apr 2021 23:31:24 +0000 (GMT) [thread overview] Message-ID: <20210420233124.247153AA7C96@sourceware.org> (raw) https://gcc.gnu.org/g:4ccdb3fdbc14102c91b6148bcbe09d0763726ae0 commit r9-9408-g4ccdb3fdbc14102c91b6148bcbe09d0763726ae0 Author: Jakub Jelinek <jakub@redhat.com> Date: Fri Jan 22 19:03:23 2021 +0100 c++: Fix up ubsan false positives on references [PR95693] Alex' 2 years old change to build_zero_init_1 to return NULL pointer with reference type for references breaks the sanitizers, the assignment of NULL to a reference typed member is then instrumented before it is overwritten with a non-NULL address later on. That change has been done to fix error recovery ICE during process_init_constructor_record, where we: if (TYPE_REF_P (fldtype)) { if (complain & tf_error) error ("member %qD is uninitialized reference", field); else return PICFLAG_ERRONEOUS; } a few lines earlier, but then continue and ICE when build_zero_init returns NULL. The following patch reverts the build_zero_init_1 change and instead creates the NULL with reference type constants during the error recovery. The pr84593.C testcase Alex' change was fixing still works as before. 2021-01-22 Jakub Jelinek <jakub@redhat.com> PR sanitizer/95693 * init.c (build_zero_init_1): Revert the 2018-03-06 change to return build_zero_cst for reference types. * typeck2.c (process_init_constructor_record): Instead call build_zero_cst here during error recovery instead of build_zero_init. * g++.dg/ubsan/pr95693.C: New test. (cherry picked from commit e5750f847158e7f9bdab770fd9c5fff58c5074d3) Diff: --- gcc/cp/init.c | 5 +---- gcc/cp/typeck2.c | 12 ++++++++---- gcc/testsuite/g++.dg/ubsan/pr95693.C | 26 ++++++++++++++++++++++++++ 3 files changed, 35 insertions(+), 8 deletions(-) diff --git a/gcc/cp/init.c b/gcc/cp/init.c index c5a01c83093..e3f190c6114 100644 --- a/gcc/cp/init.c +++ b/gcc/cp/init.c @@ -286,10 +286,7 @@ build_zero_init_1 (tree type, tree nelts, bool static_storage_p, else if (VECTOR_TYPE_P (type)) init = build_zero_cst (type); else - { - gcc_assert (TYPE_REF_P (type)); - init = build_zero_cst (type); - } + gcc_assert (TYPE_REF_P (type)); /* In all cases, the initializer is a constant. */ if (init) diff --git a/gcc/cp/typeck2.c b/gcc/cp/typeck2.c index b406368a5d6..aae5ff24c98 100644 --- a/gcc/cp/typeck2.c +++ b/gcc/cp/typeck2.c @@ -1637,10 +1637,14 @@ process_init_constructor_record (tree type, tree init, int nested, int flags, warning (OPT_Wmissing_field_initializers, "missing initializer for member %qD", field); - if (!zero_init_p (fldtype) - || skipped < 0) - next = build_zero_init (TREE_TYPE (field), /*nelts=*/NULL_TREE, - /*static_storage_p=*/false); + if (!zero_init_p (fldtype) || skipped < 0) + { + if (TYPE_REF_P (fldtype)) + next = build_zero_cst (TREE_TYPE (field)); + else + next = build_zero_init (TREE_TYPE (field), /*nelts=*/NULL_TREE, + /*static_storage_p=*/false); + } else { /* The default zero-initialization is fine for us; don't diff --git a/gcc/testsuite/g++.dg/ubsan/pr95693.C b/gcc/testsuite/g++.dg/ubsan/pr95693.C new file mode 100644 index 00000000000..13f688e8ec0 --- /dev/null +++ b/gcc/testsuite/g++.dg/ubsan/pr95693.C @@ -0,0 +1,26 @@ +// PR sanitizer/95693 +// { dg-do run } +// { dg-options "-O2 -fsanitize=undefined -fno-sanitize-recover=undefined" } + +int g = 9; + +struct A { + A () : a(g) {} +private: + int &a; +}; + +struct B { + A payload; +}; + +struct C : public B { + C () : B () {} + A p; +}; + +int +main () +{ + C t; +}
reply other threads:[~2021-04-20 23:31 UTC|newest] Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210420233124.247153AA7C96@sourceware.org \ --to=jakub@gcc.gnu.org \ --cc=gcc-cvs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).