Spurious warning for zero-sized array parameters to a function

Spurious warning for zero-sized array parameters to a function

[Alejandro Colomar]

[-- Attachment #1.1: Type: text/plain, Size: 5072 bytes --]

Hi!

In the following function, past_end is a pointer to one-past-the-end of the 
array.  Holding such a pointer is legal in C.  I use it as a sentinel value that 
helps (1) avoid overrunning the buffer, and (2) detect truncation.  I mark it as 
having a size of [0], which clearly states that it can't be dereferenced (and as 
you can see, I don't).

/*
  * This function copies an unterminated string into a string.
  * -  It never overruns the dest buffer.
  * -  It can be chained, to concatenate strings.
  * -  It detects truncation.
  * -  Truncation only needs to be tested once after all concatenations.
  * -  The name is self-documenting, compared to its alternative: strncat(3).
  */
char *
ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
{
	bool       trunc;
	char       *end;
	ptrdiff_t  len;

	if (dst == past_end)
		return past_end;

	trunc = false;
	len = strnlen(src, n);
	if (len > past_end - dst - 1) {
		len = past_end - dst - 1;
		trunc = true;
	}

	end = mempcpy(dst, src, len);
	*end = '\0';

	return trunc ? past_end : end;
}


If I compile the code above, GCC considers the function definition to be fine. 
However, at call site, it always warns:


#define nitems(arr)  (sizeof((arr)) / sizeof((arr)[0]))

int
main(void)
{
	char pre[4] = "pre.";
	char *post = ".post";
	char *src = "some-long-body.post";
	char dest[100];
         char *p, *past_end;

	past_end = dest + nitems(dest);
	p = dest;
	p = ustr2stpe(p, pre, nitems(pre), past_end);
	p = ustr2stpe(p, src, strlen(src) - strlen(post), past_end);
	p = ustr2stpe(p, "", 0, past_end);
	if (p == past_end)
		fprintf(stderr, "truncation\n");

	puts(dest);  // "pre.some-long-body"
}



$ cc -Wall -Wextra ustr2stpe.c
ustr2stpe.c: In function ‘main’:
ustr2stpe.c:43:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0 
[-Wstringop-overflow=]
    43 |         p = ustr2stpe(p, pre, nitems(pre), past_end);
       |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ustr2stpe.c:43:13: note: referencing argument 4 of type ‘char[0]’
ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
    10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
       | ^~~~~~~~~
ustr2stpe.c:44:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0 
[-Wstringop-overflow=]
    44 |         p = ustr2stpe(p, src, strlen(src) - strlen(post), past_end);
       |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ustr2stpe.c:44:13: note: referencing argument 4 of type ‘char[0]’
ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
    10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
       | ^~~~~~~~~
ustr2stpe.c:45:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0 
[-Wstringop-overflow=]
    45 |         p = ustr2stpe(p, "", 0, past_end);
       |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ustr2stpe.c:45:13: note: referencing argument 4 of type ‘char[0]’
ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
    10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
       | ^~~~~~~~~
ustr2stpe.c:43:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0 
[-Wstringop-overflow=]
    43 |         p = ustr2stpe(p, pre, nitems(pre), past_end);
       |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ustr2stpe.c:43:13: note: referencing argument 4 of type ‘char[0]’
ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
    10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
       | ^~~~~~~~~
ustr2stpe.c:44:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0 
[-Wstringop-overflow=]
    44 |         p = ustr2stpe(p, src, strlen(src) - strlen(post), past_end);
       |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ustr2stpe.c:44:13: note: referencing argument 4 of type ‘char[0]’
ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
    10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
       | ^~~~~~~~~
ustr2stpe.c:45:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0 
[-Wstringop-overflow=]
    45 |         p = ustr2stpe(p, "", 0, past_end);
       |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ustr2stpe.c:45:13: note: referencing argument 4 of type ‘char[0]’
ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
    10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
       | ^~~~~~~~~


The warnings are invalid.  While it's true that I'm referencing a pointer of 
size 0, it's false that I'm "accessing 1 byte" in that region.  I guess this is 
all about the bogus design of 'static' in ISO C, where you can have an array 
parameter of size 0, which is very useful in cases like this one.

Cheers,

Alex


-- 
<http://www.alejandro-colomar.es/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Spurious warning for zero-sized array parameters to a function

[Richard Biener]

On Tue, Dec 6, 2022 at 5:22 PM Alejandro Colomar via Gcc
<gcc@gcc.gnu.org> wrote:
>
> Hi!
>
> In the following function, past_end is a pointer to one-past-the-end of the
> array.  Holding such a pointer is legal in C.  I use it as a sentinel value that
> helps (1) avoid overrunning the buffer, and (2) detect truncation.  I mark it as
> having a size of [0], which clearly states that it can't be dereferenced (and as
> you can see, I don't).
>
> /*
>   * This function copies an unterminated string into a string.
>   * -  It never overruns the dest buffer.
>   * -  It can be chained, to concatenate strings.
>   * -  It detects truncation.
>   * -  Truncation only needs to be tested once after all concatenations.
>   * -  The name is self-documenting, compared to its alternative: strncat(3).
>   */
> char *
> ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
> {
>         bool       trunc;
>         char       *end;
>         ptrdiff_t  len;
>
>         if (dst == past_end)
>                 return past_end;
>
>         trunc = false;
>         len = strnlen(src, n);
>         if (len > past_end - dst - 1) {
>                 len = past_end - dst - 1;
>                 trunc = true;
>         }
>
>         end = mempcpy(dst, src, len);
>         *end = '\0';
>
>         return trunc ? past_end : end;
> }
>
>
> If I compile the code above, GCC considers the function definition to be fine.
> However, at call site, it always warns:
>
>
> #define nitems(arr)  (sizeof((arr)) / sizeof((arr)[0]))
>
> int
> main(void)
> {
>         char pre[4] = "pre.";
>         char *post = ".post";
>         char *src = "some-long-body.post";
>         char dest[100];
>          char *p, *past_end;
>
>         past_end = dest + nitems(dest);
>         p = dest;
>         p = ustr2stpe(p, pre, nitems(pre), past_end);
>         p = ustr2stpe(p, src, strlen(src) - strlen(post), past_end);
>         p = ustr2stpe(p, "", 0, past_end);
>         if (p == past_end)
>                 fprintf(stderr, "truncation\n");
>
>         puts(dest);  // "pre.some-long-body"
> }
>
>
>
> $ cc -Wall -Wextra ustr2stpe.c
> ustr2stpe.c: In function ‘main’:
> ustr2stpe.c:43:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0
> [-Wstringop-overflow=]
>     43 |         p = ustr2stpe(p, pre, nitems(pre), past_end);
>        |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ustr2stpe.c:43:13: note: referencing argument 4 of type ‘char[0]’
> ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
>     10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
>        | ^~~~~~~~~
> ustr2stpe.c:44:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0
> [-Wstringop-overflow=]
>     44 |         p = ustr2stpe(p, src, strlen(src) - strlen(post), past_end);
>        |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ustr2stpe.c:44:13: note: referencing argument 4 of type ‘char[0]’
> ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
>     10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
>        | ^~~~~~~~~
> ustr2stpe.c:45:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0
> [-Wstringop-overflow=]
>     45 |         p = ustr2stpe(p, "", 0, past_end);
>        |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ustr2stpe.c:45:13: note: referencing argument 4 of type ‘char[0]’
> ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
>     10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
>        | ^~~~~~~~~
> ustr2stpe.c:43:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0
> [-Wstringop-overflow=]
>     43 |         p = ustr2stpe(p, pre, nitems(pre), past_end);
>        |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ustr2stpe.c:43:13: note: referencing argument 4 of type ‘char[0]’
> ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
>     10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
>        | ^~~~~~~~~
> ustr2stpe.c:44:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0
> [-Wstringop-overflow=]
>     44 |         p = ustr2stpe(p, src, strlen(src) - strlen(post), past_end);
>        |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ustr2stpe.c:44:13: note: referencing argument 4 of type ‘char[0]’
> ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
>     10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
>        | ^~~~~~~~~
> ustr2stpe.c:45:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0
> [-Wstringop-overflow=]
>     45 |         p = ustr2stpe(p, "", 0, past_end);
>        |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ustr2stpe.c:45:13: note: referencing argument 4 of type ‘char[0]’
> ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
>     10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
>        | ^~~~~~~~~
>
>
> The warnings are invalid.  While it's true that I'm referencing a pointer of
> size 0, it's false that I'm "accessing 1 byte" in that region.  I guess this is
> all about the bogus design of 'static' in ISO C, where you can have an array
> parameter of size 0, which is very useful in cases like this one.

It looks like we run into pass_waccess::maybe_check_access_sizes doing

      if (sizidx == -1)
        {
          /* If only the pointer attribute operand was specified and
             not size, set SIZE to the greater of MINSIZE or size of
             one element of the pointed to type to detect smaller
             objects (null pointers are diagnosed in this case only
             if the pointer is also declared with attribute nonnull.  */
          if (access.second.minsize
              && access.second.minsize != HOST_WIDE_INT_M1U)
            access_nelts = build_int_cstu (sizetype, access.second.minsize);
          else if (VOID_TYPE_P (argtype) && access.second.mode == access_none)
            /* Treat access mode none on a void* argument as expecting
               as little as zero bytes.  */
            access_nelts = size_zero_node;
          else
            access_nelts = size_one_node;

and use size_one_node as fallback - it either doesn't consider [0] "valid" or
for some reason chooses to interpret it as "unknown".  Can you file a bugreport
please?

Martin?

Richard.

>
> Cheers,
>
> Alex
>
>
> --
> <http://www.alejandro-colomar.es/>

Re: Spurious warning for zero-sized array parameters to a function

[Alejandro Colomar]

[-- Attachment #1.1: Type: text/plain, Size: 1667 bytes --]

Hi Richard,

On 12/7/22 09:17, Richard Biener wrote:
[...]

>> The warnings are invalid.  While it's true that I'm referencing a pointer of
>> size 0, it's false that I'm "accessing 1 byte" in that region.  I guess this is
>> all about the bogus design of 'static' in ISO C, where you can have an array
>> parameter of size 0, which is very useful in cases like this one.
> 
> It looks like we run into pass_waccess::maybe_check_access_sizes doing
> 
>        if (sizidx == -1)
>          {
>            /* If only the pointer attribute operand was specified and
>               not size, set SIZE to the greater of MINSIZE or size of
>               one element of the pointed to type to detect smaller
>               objects (null pointers are diagnosed in this case only
>               if the pointer is also declared with attribute nonnull.  */
>            if (access.second.minsize
>                && access.second.minsize != HOST_WIDE_INT_M1U)
>              access_nelts = build_int_cstu (sizetype, access.second.minsize);
>            else if (VOID_TYPE_P (argtype) && access.second.mode == access_none)
>              /* Treat access mode none on a void* argument as expecting
>                 as little as zero bytes.  */
>              access_nelts = size_zero_node;
>            else
>              access_nelts = size_one_node;
> 
> and use size_one_node as fallback - it either doesn't consider [0] "valid" or
> for some reason chooses to interpret it as "unknown".  Can you file a bugreport
> please?

Sure;  will do!

Cheers,

Alex

> 
> Martin?
> 
> Richard.

-- 
<http://www.alejandro-colomar.es/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Spurious warning for zero-sized array parameters to a function

[msebor]

[-- Attachment #1: Type: text/plain, Size: 6511 bytes --]

> On Dec 6, 2022, at 9:22 AM, Alejandro Colomar via Gcc <gcc@gcc.gnu.org> wrote:
> 
> Hi!
> 
> In the following function, past_end is a pointer to one-past-the-end of the array.  Holding such a pointer is legal in C.  I use it as a sentinel value that helps (1) avoid overrunning the buffer, and (2) detect truncation.  I mark it as having a size of [0], which clearly states that it can't be dereferenced (and as you can see, I don't).
> 
> /*
> * This function copies an unterminated string into a string.
> * -  It never overruns the dest buffer.
> * -  It can be chained, to concatenate strings.
> * -  It detects truncation.
> * -  Truncation only needs to be tested once after all concatenations.
> * -  The name is self-documenting, compared to its alternative: strncat(3).
> */
> char *
> ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
> {
>    bool       trunc;
>    char       *end;
>    ptrdiff_t  len;
> 
>    if (dst == past_end)
>        return past_end;
> 
>    trunc = false;
>    len = strnlen(src, n);
>    if (len > past_end - dst - 1) {
>        len = past_end - dst - 1;
>        trunc = true;
>    }
> 
>    end = mempcpy(dst, src, len);
>    *end = '\0';
> 
>    return trunc ? past_end : end;
> }
> 
> 
> If I compile the code above, GCC considers the function definition to be fine. However, at call site, it always warns:
> 
> 
> #define nitems(arr)  (sizeof((arr)) / sizeof((arr)[0]))
> 
> int
> main(void)
> {
>    char pre[4] = "pre.";
>    char *post = ".post";
>    char *src = "some-long-body.post";
>    char dest[100];
>        char *p, *past_end;
> 
>    past_end = dest + nitems(dest);
>    p = dest;
>    p = ustr2stpe(p, pre, nitems(pre), past_end);
>    p = ustr2stpe(p, src, strlen(src) - strlen(post), past_end);
>    p = ustr2stpe(p, "", 0, past_end);
>    if (p == past_end)
>        fprintf(stderr, "truncation\n");
> 
>    puts(dest);  // "pre.some-long-body"
> }
> 
> 
> 
> $ cc -Wall -Wextra ustr2stpe.c
> ustr2stpe.c: In function ‘main’:
> ustr2stpe.c:43:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0 [-Wstringop-overflow=]
>   43 |         p = ustr2stpe(p, pre, nitems(pre), past_end);
>      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ustr2stpe.c:43:13: note: referencing argument 4 of type ‘char[0]’
> ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
>   10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
>      | ^~~~~~~~~
> ustr2stpe.c:44:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0 [-Wstringop-overflow=]
>   44 |         p = ustr2stpe(p, src, strlen(src) - strlen(post), past_end);
>      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ustr2stpe.c:44:13: note: referencing argument 4 of type ‘char[0]’
> ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
>   10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
>      | ^~~~~~~~~
> ustr2stpe.c:45:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0 [-Wstringop-overflow=]
>   45 |         p = ustr2stpe(p, "", 0, past_end);
>      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ustr2stpe.c:45:13: note: referencing argument 4 of type ‘char[0]’
> ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
>   10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
>      | ^~~~~~~~~
> ustr2stpe.c:43:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0 [-Wstringop-overflow=]
>   43 |         p = ustr2stpe(p, pre, nitems(pre), past_end);
>      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ustr2stpe.c:43:13: note: referencing argument 4 of type ‘char[0]’
> ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
>   10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
>      | ^~~~~~~~~
> ustr2stpe.c:44:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0 [-Wstringop-overflow=]
>   44 |         p = ustr2stpe(p, src, strlen(src) - strlen(post), past_end);
>      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ustr2stpe.c:44:13: note: referencing argument 4 of type ‘char[0]’
> ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
>   10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
>      | ^~~~~~~~~
> ustr2stpe.c:45:13: warning: ‘ustr2stpe’ accessing 1 byte in a region of size 0 [-Wstringop-overflow=]
>   45 |         p = ustr2stpe(p, "", 0, past_end);
>      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ustr2stpe.c:45:13: note: referencing argument 4 of type ‘char[0]’
> ustr2stpe.c:10:1: note: in a call to function ‘ustr2stpe’
>   10 | ustr2stpe(char *dst, const char *restrict src, size_t n, char past_end[0])
>      | ^~~~~~~~~
> 
> 
> The warnings are invalid.  While it's true that I'm referencing a pointer of size 0, it's false that I'm "accessing 1 byte" in that region.  I guess this is all about the bogus design of 'static' in ISO C, where you can have an array parameter of size 0, which is very useful in cases like this one.

Most of these warnings are designed to find simple mistakes in common use cases so "tricky," unusual, or otherwise unexpected code is likely to lead to surprises.  This warning expects that in calls to a function, every parameter declared using the array syntax (which is expected to have a nonzero bound) is passed a dereferenceable pointer as an argument.  It considers neither the definition of the function to see if it does in fact dereference the argument, nor this unlikely (and strictly invalid) use case.

The warning should not be issued if the parameter is declared as an ordinary pointer so I would suggest to use that instead.  It's possible that declaring the array parameter with attribute access none might also suppress the warning, but there is no utility in using a zero-length array in this context.  The intended purpose of the zero-length array GCC extension is as trailing members of structs in legacy (pre-C99 code) that cannot use flexible array members.  Using them anywhere else is likely to be surprising, both to tools and to readers, so the attribute on a pointer parameter would be preferable.

Martin

> 
> Cheers,
> 
> Alex
> 
> 
> -- 
> <http://www.alejandro-colomar.es/>

[-- Attachment #2: OpenPGP_signature --]
[-- Type: application/octet-stream, Size: 833 bytes --]

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE6jqH8KTroDDkXfJAnowa+77/2zIFAmOPa2EACgkQnowa+77/
2zLF6g/9HwjlNrqNgUaX44/834zxY19e53rVCZ7mY1WWXa+mYOWjXEpgic0gG0+e
2n6YjJGGbZNsQs5e8DNwnq+XG0sr4ZWzAQR2tiADXPx9khBGZaoD2NsTUk5Nm6S1
pFrVACkD9FXmOzPpm15m1/MyFA0TfR60NNlxJFP+tgB3Pc+MX521xY+7ekDfRJkf
oNlvlbdq0DovkQSP5TJRu71CtP80WNZdbefj6fseaGjHJVNg/Dx76Y+uRE51p7Te
ZJtvEILAu8h775sjtSxwNFM5IPeudA5FPJaP1BOffnhXFVO4ncVtiVJsre2CM+AZ
lCFf9sYWX3KbYPFEwwmTIYCBDtuju4hZjrFvwvHywfgIKaiTMriBxnT3OCEVXI72
rZOZlvZpSwnf9EuKJ0UFdXgYwi8/OeB+wwh9+AfdkIuEQLZ8Qt/CJOcsnEaS5I1D
nmi9xifcPSvF7FAb9Ugjkw44KRPttRwrGUSK2lK14/Al/z6yngf+UFmsPcYDV8pH
NiJg2vwQ6Ovf75ua36afittM1fpj9Bwwefo1cQWbvHcbShMRjuu50Lq2ArWQFN1B
5FYoY5Cl3YR9AatITkPWEpb5l0A+Z4KK0kanmQVSIAiGyzc/bLivTOg0nvCb8HKj
5+RnCx7m4q+ATrwRX4qcho3E/YuT1FN/KYw+vCmn+F4fDzizqvM=
=3WDu
-----END PGP SIGNATURE-----

Re: Spurious warning for zero-sized array parameters to a function

[Alejandro Colomar]

[-- Attachment #1.1: Type: text/plain, Size: 2769 bytes --]

Hi Martin,

On 12/9/22 21:04, msebor@gmail.com wrote:
> 
> Most of these warnings are designed to find simple mistakes in common use cases so "tricky," unusual, or otherwise unexpected code is likely to lead to surprises.  This warning expects that in calls to a function, every parameter declared using the array syntax (which is expected to have a nonzero bound) is passed a dereferenceable pointer as an argument.  It considers neither the definition of the function to see if it does in fact dereference the argument, nor this unlikely (and strictly invalid) use case.

Hi Martin,

Is it really invalid?  AFAIK, ISO C doesn't specify anything for array syntax in 
function parameters othen than that they are equivalent to a pointer.  The only 
exception is when using 'static', which requires a minimum of 0.  So, [0], by 
not using 'static', is conforming code, I believe.  Or does the restriction to 
0-sized arrays also apply to function parameters?  What if you pass a size of 0 
through a variable?  I don't think it's undefined behavior to do so.

Could you please quote the standard about being "strictly invalid"?

Cheers,

Alex

> 
> The warning should not be issued if the parameter is declared as an ordinary pointer

I confirm; it doesn't warn.

> so I would suggest to use that instead.  It's possible that declaring the array parameter with attribute access none might also suppress the warning, but there is no utility in using a zero-length array in this context.  The intended purpose of the zero-length array GCC extension is as trailing members of structs in legacy (pre-C99 code) that cannot use flexible array members.  Using them anywhere else is likely to be surprising, both to tools and to readers, so the attribute on a pointer parameter would be preferable.

Heh, then the following function will blow brains :P


char *
stpecpy(char *dst, const char *restrict src, char past_end[0])
{
	char *p;

	if (dst == past_end)
		return past_end;

	p = memccpy(dst, src, '\0', past_end - dst);
	if (p != NULL)
		return p - 1;

	/* truncation detected */
	past_end[-1] = '\0';
	return past_end;
}

which similar to strscpy(9), but allows chaining.

In this case, I can't even use the access attribute.  I _need_ to use the 
'past_end' pointer to access the array (or perform unnecessary pointer 
arithmetic that would hurt readability: 'p = &dst[past_end - dst];').


For the curious, a variant that behaves like strlcpy(3), can be implemented as:

inline char *
stpecpyx(char *dst, const char *restrict src, char past_end[0])
{
	if (src[strlen(src)] != '\0')
		raise(SIGSEGV);

	return stpecpy(dst, src, past_end);
}


Cheers,

Alex

-- 
<http://www.alejandro-colomar.es/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Spurious warning for zero-sized array parameters to a function

[Alejandro Colomar]

[-- Attachment #1.1: Type: text/plain, Size: 3226 bytes --]



On 12/9/22 21:19, Alejandro Colomar wrote:
> Hi Martin,
> 
> On 12/9/22 21:04, msebor@gmail.com wrote:
>>
>> Most of these warnings are designed to find simple mistakes in common use 
>> cases so "tricky," unusual, or otherwise unexpected code is likely to lead to 
>> surprises.  This warning expects that in calls to a function, every parameter 
>> declared using the array syntax (which is expected to have a nonzero bound) is 
>> passed a dereferenceable pointer as an argument.  It considers neither the 
>> definition of the function to see if it does in fact dereference the argument, 
>> nor this unlikely (and strictly invalid) use case.
> 
> Hi Martin,
> 
> Is it really invalid?  AFAIK, ISO C doesn't specify anything for array syntax in 
> function parameters othen than that they are equivalent to a pointer.  The only 
> exception is when using 'static', which requires a minimum of 0.

Oops, typo there.  I wanted to say that 'static' requires a minimum of 1.

>  So, [0], by 
> not using 'static', is conforming code, I believe.  Or does the restriction to 
> 0-sized arrays also apply to function parameters?  What if you pass a size of 0 
> through a variable?  I don't think it's undefined behavior to do so.
> 
> Could you please quote the standard about being "strictly invalid"?
> 
> Cheers,
> 
> Alex
> 
>>
>> The warning should not be issued if the parameter is declared as an ordinary 
>> pointer
> 
> I confirm; it doesn't warn.
> 
>> so I would suggest to use that instead.  It's possible that declaring the 
>> array parameter with attribute access none might also suppress the warning, 
>> but there is no utility in using a zero-length array in this context.  The 
>> intended purpose of the zero-length array GCC extension is as trailing members 
>> of structs in legacy (pre-C99 code) that cannot use flexible array members.  
>> Using them anywhere else is likely to be surprising, both to tools and to 
>> readers, so the attribute on a pointer parameter would be preferable.
> 
> Heh, then the following function will blow brains :P
> 
> 
> char *
> stpecpy(char *dst, const char *restrict src, char past_end[0])
> {
>      char *p;
> 
>      if (dst == past_end)
>          return past_end;
> 
>      p = memccpy(dst, src, '\0', past_end - dst);
>      if (p != NULL)
>          return p - 1;
> 
>      /* truncation detected */
>      past_end[-1] = '\0';
>      return past_end;
> }
> 
> which similar to strscpy(9), but allows chaining.
> 
> In this case, I can't even use the access attribute.  I _need_ to use the 
> 'past_end' pointer to access the array (or perform unnecessary pointer 
> arithmetic that would hurt readability: 'p = &dst[past_end - dst];').
> 
> 
> For the curious, a variant that behaves like strlcpy(3), can be implemented as:
> 
> inline char *
> stpecpyx(char *dst, const char *restrict src, char past_end[0])
> {
>      if (src[strlen(src)] != '\0')
>          raise(SIGSEGV);
> 
>      return stpecpy(dst, src, past_end);
> }
> 
> 
> Cheers,
> 
> Alex
> 

-- 
<http://www.alejandro-colomar.es/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]