* [pushed] analyzer: fix ICE on division of tainted floating-point values [PR110700]
@ 2023-07-19 22:01 David Malcolm
0 siblings, 0 replies; only message in thread
From: David Malcolm @ 2023-07-19 22:01 UTC (permalink / raw)
To: gcc-patches; +Cc: David Malcolm
Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu.
Pushed to trunk as r14-2658-gb86c0fe327a519.
gcc/analyzer/ChangeLog:
PR analyzer/110700
* region-model-manager.cc
(region_model_manager::get_or_create_int_cst): Assert that we have
an integral or pointer type.
* sm-taint.cc (taint_state_machine::check_for_tainted_divisor):
Don't check non-integral types.
gcc/testsuite/ChangeLog:
PR analyzer/110700
* gcc.dg/analyzer/taint-divisor-2.c: New test.
---
gcc/analyzer/region-model-manager.cc | 1 +
gcc/analyzer/sm-taint.cc | 6 ++++++
gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c | 13 +++++++++++++
3 files changed, 20 insertions(+)
create mode 100644 gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c
diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc
index 4f11ef4bd29..e43b99ae0ba 100644
--- a/gcc/analyzer/region-model-manager.cc
+++ b/gcc/analyzer/region-model-manager.cc
@@ -234,6 +234,7 @@ region_model_manager::get_or_create_int_cst (tree type,
const poly_wide_int_ref &cst)
{
gcc_assert (type);
+ gcc_assert (INTEGRAL_TYPE_P (type) || POINTER_TYPE_P (type));
tree tree_cst = wide_int_to_tree (type, cst);
return get_or_create_constant_svalue (tree_cst);
}
diff --git a/gcc/analyzer/sm-taint.cc b/gcc/analyzer/sm-taint.cc
index 6d28d1f6f65..09c1e9368cd 100644
--- a/gcc/analyzer/sm-taint.cc
+++ b/gcc/analyzer/sm-taint.cc
@@ -1344,6 +1344,12 @@ taint_state_machine::check_for_tainted_divisor (sm_context *sm_ctxt,
return;
tree divisor_expr = gimple_assign_rhs2 (assign);;
+
+ /* Until we track conditions on floating point values, we can't check to
+ see if they've been checked against zero. */
+ if (!INTEGRAL_TYPE_P (TREE_TYPE (divisor_expr)))
+ return;
+
const svalue *divisor_sval = old_model->get_rvalue (divisor_expr, NULL);
state_t state = sm_ctxt->get_state (assign, divisor_sval);
diff --git a/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c b/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c
new file mode 100644
index 00000000000..de9a1cb3a46
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c
@@ -0,0 +1,13 @@
+// TODO: remove need for this option:
+/* { dg-additional-options "-fanalyzer-checker=taint" } */
+
+#include "analyzer-decls.h"
+
+__attribute__ ((tainted_args))
+double pr110700 (double x, double y)
+{
+ /* Ideally we'd complain here with -Wanalyzer-tainted-divisor, but
+ until we track conditions on floating point values, we can't check to
+ see if they've been checked against zero. */
+ return x / y;
+}
--
2.26.3
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2023-07-19 22:01 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-19 22:01 [pushed] analyzer: fix ICE on division of tainted floating-point values [PR110700] David Malcolm
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).