From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id 71965385E836 for ; Thu, 9 May 2024 17:42:51 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 71965385E836 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 71965385E836 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1715276572; cv=none; b=Undc/yN/jyo5u559jNA/ejflrM2kHP780My8d2KGjxLutiKoS4iQTj020NE4IY/VhCKb+7/if29RS3HqXi6kCIRmxB6WOcBASSTAMUoz1MoT1IQ7xnZTsUzRw6yUIB6wZGFNeeeRZtw/ufMARGfKQBv2LZbeCab8AY6k+BJoD3c= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1715276572; c=relaxed/simple; bh=61huQndRK4S5gcGW9AnTB41jCc9VAzAPJJxrtAJh/rw=; h=DKIM-Signature:From:To:Subject:Date:Message-Id:MIME-Version; b=OB6mOBEYC/gqU6Lb1juIuIFkwSBxY5YRxhMQW4a+tfPQyMadSapGknXV/OSswp5JLWGZrTXwTv7Y/c8TcDHSD7Ju/L6dUYn/gKbti9JNabJOjwmWSEkrgbYN1ZsonldbappYdRLRjkrwyzQd97O1+0tixEuNda9DG85kfTkEzfA= ARC-Authentication-Results: i=1; server2.sourceware.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1715276571; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=qUAyGmGU4poPpo4pX7+XvLlGD6HBmYKZ81Buh4nBctE=; b=a6JwThnpUPRX2KrVgmy/qgywf7fz2DkkBFzgULp97k7zLtrciPu1djHPc+HUYUPIe1G3ew +OEM+cQbE9Xihif3NSCPXKy06bwGaYGpuWPWrKXZ6/Ua75lmBe1SXGu5Pt0V3NGC+KCljI 0UV2oucg0JkPVz2klIq/vpmQopcXgAc= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-131-qsCK8o4NPAuGPno1bnfuPA-1; Thu, 09 May 2024 13:42:49 -0400 X-MC-Unique: qsCK8o4NPAuGPno1bnfuPA-1 Received: from smtp.corp.redhat.com (int-mx10.intmail.prod.int.rdu2.redhat.com [10.11.54.10]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 3EE3E18188A3 for ; Thu, 9 May 2024 17:42:49 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.18.2]) by smtp.corp.redhat.com (Postfix) with ESMTP id 13F20746826; Thu, 9 May 2024 17:42:49 +0000 (UTC) From: David Malcolm To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [PATCH 06/21] analyzer: fix ICE on division of tainted floating-point values [PR110700] Date: Thu, 9 May 2024 13:42:21 -0400 Message-Id: <20240509174236.2278921-7-dmalcolm@redhat.com> In-Reply-To: <20240509174236.2278921-1-dmalcolm@redhat.com> References: <20240509174236.2278921-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.10 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII"; x-default=true X-Spam-Status: No, score=-11.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: gcc/analyzer/ChangeLog: PR analyzer/110700 * region-model-manager.cc (region_model_manager::get_or_create_int_cst): Assert that we have an integral or pointer type. * sm-taint.cc (taint_state_machine::check_for_tainted_divisor): Don't check non-integral types. gcc/testsuite/ChangeLog: PR analyzer/110700 * gcc.dg/analyzer/taint-divisor-2.c: New test. (cherry picked from commit r14-2658-gb86c0fe327a519) Signed-off-by: David Malcolm --- gcc/analyzer/region-model-manager.cc | 3 ++- gcc/analyzer/sm-taint.cc | 6 ++++++ gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c | 13 +++++++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc index fab5bba15d5..1a9886fd83c 100644 --- a/gcc/analyzer/region-model-manager.cc +++ b/gcc/analyzer/region-model-manager.cc @@ -233,7 +233,8 @@ const svalue * region_model_manager::get_or_create_int_cst (tree type, poly_int64 val) { gcc_assert (type); - tree tree_cst = build_int_cst (type, val); + gcc_assert (INTEGRAL_TYPE_P (type) || POINTER_TYPE_P (type)); + tree tree_cst = wide_int_to_tree (type, val); return get_or_create_constant_svalue (tree_cst); } diff --git a/gcc/analyzer/sm-taint.cc b/gcc/analyzer/sm-taint.cc index f72f194460c..7bce3ef79b2 100644 --- a/gcc/analyzer/sm-taint.cc +++ b/gcc/analyzer/sm-taint.cc @@ -1344,6 +1344,12 @@ taint_state_machine::check_for_tainted_divisor (sm_context *sm_ctxt, return; tree divisor_expr = gimple_assign_rhs2 (assign);; + + /* Until we track conditions on floating point values, we can't check to + see if they've been checked against zero. */ + if (!INTEGRAL_TYPE_P (TREE_TYPE (divisor_expr))) + return; + const svalue *divisor_sval = old_model->get_rvalue (divisor_expr, NULL); state_t state = sm_ctxt->get_state (assign, divisor_sval); diff --git a/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c b/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c new file mode 100644 index 00000000000..de9a1cb3a46 --- /dev/null +++ b/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c @@ -0,0 +1,13 @@ +// TODO: remove need for this option: +/* { dg-additional-options "-fanalyzer-checker=taint" } */ + +#include "analyzer-decls.h" + +__attribute__ ((tainted_args)) +double pr110700 (double x, double y) +{ + /* Ideally we'd complain here with -Wanalyzer-tainted-divisor, but + until we track conditions on floating point values, we can't check to + see if they've been checked against zero. */ + return x / y; +} -- 2.26.3