From: Bernd Edlinger <bernd.edlinger@hotmail.de>
To: Martin Sebor <msebor@gmail.com>, Jeff Law <law@redhat.com>,
"gcc-patches@gcc.gnu.org" <gcc-patches@gcc.gnu.org>,
Joseph Myers <joseph@codesourcery.com>,
Jason Merrill <jason@redhat.com>, Nathan Sidwell <nathan@acm.org>
Subject: [PING**2] [PATCH] Add a warning for invalid function casts
Date: Wed, 15 Nov 2017 20:52:00 -0000 [thread overview]
Message-ID: <AM5PR0701MB26571500A4872E7DF4DF31FFE4290@AM5PR0701MB2657.eurprd07.prod.outlook.com> (raw)
In-Reply-To: <e64a07da-bada-893e-d1e4-bf4705cc1731@hotmail.de>
Ping...
On 11/08/17 17:55, Bernd Edlinger wrote:
> Ping...
>
> for the C++ part of this patch:
>
> https://gcc.gnu.org/ml/gcc-patches/2017-10/msg00559.html
>
>
> Thanks
> Bernd.
>
>> On 10/10/17 00:30, Bernd Edlinger wrote:
>>> On 10/09/17 20:34, Martin Sebor wrote:
>>>> On 10/09/2017 11:50 AM, Bernd Edlinger wrote:
>>>>> On 10/09/17 18:44, Martin Sebor wrote:
>>>>>> On 10/07/2017 10:48 AM, Bernd Edlinger wrote:
>>>>>>> Hi!
>>>>>>>
>>>>>>> I think I have now something useful, it has a few more heuristics
>>>>>>> added, to reduce the number of false-positives so that it
>>>>>>> is able to find real bugs, for instance in openssl it triggers
>>>>>>> at a function cast which has already a TODO on it.
>>>>>>>
>>>>>>> The heuristics are:
>>>>>>> - handle void (*)(void) as a wild-card function type.
>>>>>>> - ignore volatile, const qualifiers on parameters/return.
>>>>>>> - handle any pointers as equivalent.
>>>>>>> - handle integral types, enums, and booleans of same precision
>>>>>>> and signedness as equivalent.
>>>>>>> - stop parameter validation at the first "...".
>>>>>>
>>>>>> These sound quite reasonable to me. I have a reservation about
>>>>>> just one of them, and some comments about other aspects of the
>>>>>> warning. Sorry if this seems like a lot. I'm hoping you'll
>>>>>> find the feedback constructive.
>>>>>>
>>>>>> I don't think using void(*)(void) to suppress the warning is
>>>>>> a robust solution because it's not safe to call a function that
>>>>>> takes arguments through such a pointer (especially not if one
>>>>>> or more of the arguments is a pointer). Depending on the ABI,
>>>>>> calling a function that expects arguments with none could also
>>>>>> mess up the stack as the callee may pop arguments that were
>>>>>> never passed to it.
>>>>>>
>>>>>
>>>>> This is of course only a heuristic, and if there is no warning
>>>>> that does not mean any guarantee that there can't be a problem
>>>>> at runtime. The heuristic is only meant to separate the
>>>>> bad from the very bad type-cast. In my personal opinion there
>>>>> is not a single good type cast.
>>>>
>>>> I agree. Since the warning uses one kind of a cast as an escape
>>>> mechanism from the checking it should be one whose result can
>>>> the most likely be used to call the function without undefined
>>>> behavior.
>>>>
>>>> Since it's possible to call any function through a pointer to
>>>> a function with no arguments (simply by providing arguments of
>>>> matching types) it's a reasonable candidate.
>>>>
>>>> On the other hand, since it is not safe to call an arbitrary
>>>> function through void (*)(void), it's not as good a candidate.
>>>>
>>>> Another reason why I think a protoype-less function is a good
>>>> choice is because the alias and ifunc attributes already use it
>>>> as an escape mechanism from their type incompatibility warning.
>>>>
>>>
>>> I know of pre-existing code-bases where a type-cast to type:
>>> void (*) (void);
>>>
>>> .. is already used as a generic function pointer: libffi and
>>> libgo, I would not want to break these.
>>>
>>> Actually when I have a type:
>>> X (*) (...);
>>>
>>> I would like to make sure that the warning checks that
>>> only functions returning X are assigned.
>>>
>>> and for X (*) (Y, ....);
>>>
>>> I would like to check that anything returning X with
>>> first argument of type Y is assigned.
>>>
>>> There are code bases where such a scheme is used.
>>> For instance one that I myself maintain: the OPC/UA AnsiC Stack,
>>> where I have this type definition:
>>>
>>> typedef OpcUa_StatusCode (OpcUa_PfnInvokeService)(OpcUa_Endpoint
>>> hEndpoint, ...);
>>>
>>> And this plays well together with this warning, because only
>>> functions are assigned that match up to the ...);
>>> Afterwards this pointer is cast back to the original signature,
>>> so everything is perfectly fine.
>>>
>>> Regarding the cast from pointer to member to function, I see also a
>>> warning without -Wpedantic:
>>> Warnung: converting from »void (S::*)(int*)« to »void (*)(int*)«
>>> [-Wpmf-conversions]
>>> F *pf = (F*)&S::foo;
>>> ^~~
>>>
>>> And this one is even default-enabled, so I think that should be
>>> more than sufficient.
>>>
>>> I also changed the heuristic, so that your example with the enum should
>>> now work. I did not add it to the test case, because it would
>>> break with -fshort-enums :(
>>>
>>> Attached I have an updated patch that extends this warning to the
>>> pointer-to-member function cast, and relaxes the heuristic on the
>>> benign integral type differences a bit further.
>>>
>>>
>>> Is it OK for trunk after bootstrap and reg-testing?
>>>
>>>
>>> Thanks
>>> Bernd.
>>>
next prev parent reply other threads:[~2017-11-15 20:03 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-03 19:33 [RFA] " Bernd Edlinger
2017-10-03 21:34 ` Joseph Myers
2017-10-05 14:03 ` Bernd Edlinger
2017-10-05 14:10 ` Joseph Myers
2017-10-05 0:25 ` Eric Gallager
2017-10-05 13:39 ` Bernd Edlinger
2017-10-05 14:06 ` Andreas Schwab
2017-10-05 18:22 ` Eric Gallager
2017-10-05 16:16 ` Martin Sebor
2017-10-05 21:04 ` Bernd Edlinger
2017-10-05 21:47 ` Joseph Myers
2017-10-06 20:50 ` Jeff Law
2017-10-05 22:17 ` Martin Sebor
2017-10-06 13:26 ` Bernd Edlinger
2017-10-06 15:43 ` Martin Sebor
2017-10-06 18:25 ` Bernd Edlinger
2017-10-06 20:43 ` Martin Sebor
2017-10-06 21:01 ` Jeff Law
2017-10-06 22:23 ` Bernd Edlinger
2017-10-07 18:23 ` Bernd Edlinger
2017-10-09 16:48 ` Martin Sebor
2017-10-09 18:19 ` Bernd Edlinger
2017-10-09 18:46 ` Martin Sebor
2017-10-09 22:33 ` Bernd Edlinger
2017-10-10 15:35 ` Martin Sebor
2017-10-10 16:55 ` Joseph Myers
2017-10-10 17:39 ` Martin Sebor
2017-10-10 23:57 ` Joseph Myers
2017-10-11 3:52 ` Martin Sebor
2017-10-11 17:28 ` Joseph Myers
2017-10-11 18:04 ` Martin Sebor
2017-10-12 11:45 ` Pedro Alves
2017-10-12 11:52 ` Pedro Alves
2017-10-12 11:59 ` Pedro Alves
2017-10-12 15:26 ` Martin Sebor
2017-10-12 15:37 ` Joseph Myers
2017-10-21 9:54 ` Bernd Edlinger
2017-11-03 21:47 ` Joseph Myers
[not found] ` <fa771535-8fcf-9b22-b5b9-eb928af5e817@hotmail.de>
2017-11-08 17:03 ` [PING] " Bernd Edlinger
[not found] ` <e64a07da-bada-893e-d1e4-bf4705cc1731@hotmail.de>
2017-11-15 20:52 ` Bernd Edlinger [this message]
2017-11-29 22:17 ` Jason Merrill
2017-11-30 15:45 ` [PATCHv2] " Bernd Edlinger
2017-11-30 15:56 ` Jason Merrill
2017-11-30 16:22 ` Bernd Edlinger
2017-11-30 17:32 ` Jason Merrill
2017-11-30 18:06 ` Bernd Edlinger
2017-11-30 18:19 ` Jason Merrill
2017-11-30 18:39 ` Bernd Edlinger
2017-11-30 18:39 ` Jason Merrill
2017-12-01 12:42 ` [PATCHv3] " Bernd Edlinger
2017-12-06 22:36 ` Jason Merrill
2017-12-07 20:48 ` Bernd Edlinger
2017-12-14 18:50 ` Jason Merrill
[not found] ` <1c3d1b9b-7a25-fae3-5c44-1a0efae77cc8@hotmail.de>
2017-12-14 18:35 ` Bernd Edlinger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=AM5PR0701MB26571500A4872E7DF4DF31FFE4290@AM5PR0701MB2657.eurprd07.prod.outlook.com \
--to=bernd.edlinger@hotmail.de \
--cc=gcc-patches@gcc.gnu.org \
--cc=jason@redhat.com \
--cc=joseph@codesourcery.com \
--cc=law@redhat.com \
--cc=msebor@gmail.com \
--cc=nathan@acm.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).