From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2153) id 247153AA7C96; Tue, 20 Apr 2021 23:31:24 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 247153AA7C96 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="utf-8" From: Jakub Jelinek To: gcc-cvs@gcc.gnu.org Subject: [gcc r9-9408] c++: Fix up ubsan false positives on references [PR95693] X-Act-Checkin: gcc X-Git-Author: Jakub Jelinek X-Git-Refname: refs/heads/releases/gcc-9 X-Git-Oldrev: 45a6eae129c6fee387a3bb7075181d8509fa6e2a X-Git-Newrev: 4ccdb3fdbc14102c91b6148bcbe09d0763726ae0 Message-Id: <20210420233124.247153AA7C96@sourceware.org> Date: Tue, 20 Apr 2021 23:31:24 +0000 (GMT) X-BeenThere: gcc-cvs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-cvs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Apr 2021 23:31:24 -0000 https://gcc.gnu.org/g:4ccdb3fdbc14102c91b6148bcbe09d0763726ae0 commit r9-9408-g4ccdb3fdbc14102c91b6148bcbe09d0763726ae0 Author: Jakub Jelinek Date: Fri Jan 22 19:03:23 2021 +0100 c++: Fix up ubsan false positives on references [PR95693] Alex' 2 years old change to build_zero_init_1 to return NULL pointer with reference type for references breaks the sanitizers, the assignment of NULL to a reference typed member is then instrumented before it is overwritten with a non-NULL address later on. That change has been done to fix error recovery ICE during process_init_constructor_record, where we: if (TYPE_REF_P (fldtype)) { if (complain & tf_error) error ("member %qD is uninitialized reference", field); else return PICFLAG_ERRONEOUS; } a few lines earlier, but then continue and ICE when build_zero_init returns NULL. The following patch reverts the build_zero_init_1 change and instead creates the NULL with reference type constants during the error recovery. The pr84593.C testcase Alex' change was fixing still works as before. 2021-01-22 Jakub Jelinek PR sanitizer/95693 * init.c (build_zero_init_1): Revert the 2018-03-06 change to return build_zero_cst for reference types. * typeck2.c (process_init_constructor_record): Instead call build_zero_cst here during error recovery instead of build_zero_init. * g++.dg/ubsan/pr95693.C: New test. (cherry picked from commit e5750f847158e7f9bdab770fd9c5fff58c5074d3) Diff: --- gcc/cp/init.c | 5 +---- gcc/cp/typeck2.c | 12 ++++++++---- gcc/testsuite/g++.dg/ubsan/pr95693.C | 26 ++++++++++++++++++++++++++ 3 files changed, 35 insertions(+), 8 deletions(-) diff --git a/gcc/cp/init.c b/gcc/cp/init.c index c5a01c83093..e3f190c6114 100644 --- a/gcc/cp/init.c +++ b/gcc/cp/init.c @@ -286,10 +286,7 @@ build_zero_init_1 (tree type, tree nelts, bool static_storage_p, else if (VECTOR_TYPE_P (type)) init = build_zero_cst (type); else - { - gcc_assert (TYPE_REF_P (type)); - init = build_zero_cst (type); - } + gcc_assert (TYPE_REF_P (type)); /* In all cases, the initializer is a constant. */ if (init) diff --git a/gcc/cp/typeck2.c b/gcc/cp/typeck2.c index b406368a5d6..aae5ff24c98 100644 --- a/gcc/cp/typeck2.c +++ b/gcc/cp/typeck2.c @@ -1637,10 +1637,14 @@ process_init_constructor_record (tree type, tree init, int nested, int flags, warning (OPT_Wmissing_field_initializers, "missing initializer for member %qD", field); - if (!zero_init_p (fldtype) - || skipped < 0) - next = build_zero_init (TREE_TYPE (field), /*nelts=*/NULL_TREE, - /*static_storage_p=*/false); + if (!zero_init_p (fldtype) || skipped < 0) + { + if (TYPE_REF_P (fldtype)) + next = build_zero_cst (TREE_TYPE (field)); + else + next = build_zero_init (TREE_TYPE (field), /*nelts=*/NULL_TREE, + /*static_storage_p=*/false); + } else { /* The default zero-initialization is fine for us; don't diff --git a/gcc/testsuite/g++.dg/ubsan/pr95693.C b/gcc/testsuite/g++.dg/ubsan/pr95693.C new file mode 100644 index 00000000000..13f688e8ec0 --- /dev/null +++ b/gcc/testsuite/g++.dg/ubsan/pr95693.C @@ -0,0 +1,26 @@ +// PR sanitizer/95693 +// { dg-do run } +// { dg-options "-O2 -fsanitize=undefined -fno-sanitize-recover=undefined" } + +int g = 9; + +struct A { + A () : a(g) {} +private: + int &a; +}; + +struct B { + A payload; +}; + +struct C : public B { + C () : B () {} + A p; +}; + +int +main () +{ + C t; +}