[BUG] missing warning for pointer arithmetic out of bounds

[BUG] missing warning for pointer arithmetic out of bounds

[Alejandro Colomar]

[-- Attachment #1.1: Type: text/plain, Size: 946 bytes --]

Hi!

For the following program:


     $ cat buf.c
     #include <stdio.h>

     int main(void)
     {
         char *p, buf[5];

         p = buf + 6;
         printf("%p\n", p);
     }


There are no warnings in gcc, as I would expect:

     $ gcc -Wall -Wextra buf.c -O0

Clang does warn, however:

     $ clang -Weverything -Wall -Wextra buf.c -O0
     buf.c:8:17: warning: format specifies type 'void *' but the argument has 
type 'char *' [-Wformat-pedantic]
         printf("%p\n", p);
                 ~~     ^
                 %s
     buf.c:7:6: warning: the pointer incremented by 6 refers past the end of the 
array (that contains 5 elements) [-Warray-bounds-pointer-arithmetic]
         p = buf + 6;
             ^     ~
     buf.c:5:2: note: array 'buf' declared here
         char *p, buf[5];
         ^
     2 warnings generated.

Cheers,

Alex


-- 
<http://www.alejandro-colomar.es/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [BUG] missing warning for pointer arithmetic out of bounds

[Alejandro Colomar]

[-- Attachment #1.1: Type: text/plain, Size: 1299 bytes --]



On 12/13/22 20:08, Alejandro Colomar wrote:
> Hi!
> 
> For the following program:
> 
> 
>      $ cat buf.c
>      #include <stdio.h>
> 
>      int main(void)
>      {
>          char *p, buf[5];
> 
>          p = buf + 6;
>          printf("%p\n", p);
>      }
> 
> 
> There are no warnings in gcc, as I would expect:

I just re-read my text, and it is ambiguous.  I meant that I expect warnings.


> 
>      $ gcc -Wall -Wextra buf.c -O0
> 
> Clang does warn, however:
> 
>      $ clang -Weverything -Wall -Wextra buf.c -O0
>      buf.c:8:17: warning: format specifies type 'void *' but the argument has 
> type 'char *' [-Wformat-pedantic]
>          printf("%p\n", p);
>                  ~~     ^
>                  %s
>      buf.c:7:6: warning: the pointer incremented by 6 refers past the end of the 
> array (that contains 5 elements) [-Warray-bounds-pointer-arithmetic]
>          p = buf + 6;
>              ^     ~
>      buf.c:5:2: note: array 'buf' declared here
>          char *p, buf[5];
>          ^
>      2 warnings generated.
> 
> Cheers,
> 
> Alex
> 
> 

-- 
<http://www.alejandro-colomar.es/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [BUG] missing warning for pointer arithmetic out of bounds

[Andrew Pinski]

On Tue, Dec 13, 2022 at 11:16 AM Alejandro Colomar via Gcc
<gcc@gcc.gnu.org> wrote:
>
>
>
> On 12/13/22 20:08, Alejandro Colomar wrote:
> > Hi!
> >
> > For the following program:
> >
> >
> >      $ cat buf.c
> >      #include <stdio.h>
> >
> >      int main(void)
> >      {
> >          char *p, buf[5];
> >
> >          p = buf + 6;
> >          printf("%p\n", p);
> >      }
> >
> >
> > There are no warnings in gcc, as I would expect:
>
> I just re-read my text, and it is ambiguous.  I meant that I expect warnings.

GCC only warns during VRP which is only enabled at -O2:

<source>:8:12: warning: array subscript 6 is outside array bounds of
'char[5]' [-Warray-bounds=]
    8 |          p = buf + 6;
      |          ~~^~~~~~~~~
<source>:6:19: note: at offset 6 into object 'buf' of size 5
    6 |          char *p, buf[5];
      |                   ^~~

Thanks,
Andrew


>
>
> >
> >      $ gcc -Wall -Wextra buf.c -O0
> >
> > Clang does warn, however:
> >
> >      $ clang -Weverything -Wall -Wextra buf.c -O0
> >      buf.c:8:17: warning: format specifies type 'void *' but the argument has
> > type 'char *' [-Wformat-pedantic]
> >          printf("%p\n", p);
> >                  ~~     ^
> >                  %s
> >      buf.c:7:6: warning: the pointer incremented by 6 refers past the end of the
> > array (that contains 5 elements) [-Warray-bounds-pointer-arithmetic]
> >          p = buf + 6;
> >              ^     ~
> >      buf.c:5:2: note: array 'buf' declared here
> >          char *p, buf[5];
> >          ^
> >      2 warnings generated.
> >
> > Cheers,
> >
> > Alex
> >
> >
>
> --
> <http://www.alejandro-colomar.es/>

Re: [BUG] missing warning for pointer arithmetic out of bounds

[David Malcolm]

On Tue, 2022-12-13 at 20:15 +0100, Alejandro Colomar via Gcc wrote:
> 
> 
> On 12/13/22 20:08, Alejandro Colomar wrote:
> > Hi!
> > 
> > For the following program:
> > 
> > 
> >      $ cat buf.c
> >      #include <stdio.h>
> > 
> >      int main(void)
> >      {
> >          char *p, buf[5];
> > 
> >          p = buf + 6;
> >          printf("%p\n", p);
> >      }
> > 
> > 
> > There are no warnings in gcc, as I would expect:
> 
> I just re-read my text, and it is ambiguous.  I meant that I expect
> warnings.

Yeah, it would be good to warn about such code.

Looking in bugzilla, I see:
  https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81172
which seems to talk about this issue, but that bug was closed as
resolved on 2020-04-13; I'm not sure what happened here.

Dave


> 
> 
> > 
> >      $ gcc -Wall -Wextra buf.c -O0
> > 
> > Clang does warn, however:
> > 
> >      $ clang -Weverything -Wall -Wextra buf.c -O0
> >      buf.c:8:17: warning: format specifies type 'void *' but the
> > argument has 
> > type 'char *' [-Wformat-pedantic]
> >          printf("%p\n", p);
> >                  ~~     ^
> >                  %s
> >      buf.c:7:6: warning: the pointer incremented by 6 refers past
> > the end of the 
> > array (that contains 5 elements) [-Warray-bounds-pointer-
> > arithmetic]
> >          p = buf + 6;
> >              ^     ~
> >      buf.c:5:2: note: array 'buf' declared here
> >          char *p, buf[5];
> >          ^
> >      2 warnings generated.
> > 
> > Cheers,
> > 
> > Alex
> > 
> > 
> 
> -- 
> <http://www.alejandro-colomar.es/>

Re: [BUG] missing warning for pointer arithmetic out of bounds

[Paul Koning]

> On Dec 13, 2022, at 2:08 PM, Alejandro Colomar via Gcc <gcc@gcc.gnu.org> wrote:
> 
> Hi!
> 
> For the following program:
> 
> 
>    $ cat buf.c
>    #include <stdio.h>
> 
>    int main(void)
>    {
>        char *p, buf[5];
> 
>        p = buf + 6;
>        printf("%p\n", p);
>    }
> 
> 
> There are no warnings in gcc, as I would expect:
> 
>    $ gcc -Wall -Wextra buf.c -O0
> 
> Clang does warn, however:
> 
>    $ clang -Weverything -Wall -Wextra buf.c -O0
>    buf.c:8:17: warning: format specifies type 'void *' but the argument has type 'char *' [-Wformat-pedantic]
>        printf("%p\n", p);
>                ~~     ^
>                %s
>    buf.c:7:6: warning: the pointer incremented by 6 refers past the end of the array (that contains 5 elements) [-Warray-bounds-pointer-arithmetic]
>        p = buf + 6;
>            ^     ~

I thought void * is a generic pointer that accepts any pointer argument.  So a warning about char* being passed in seems to be flat out wrong.

>    buf.c:5:2: note: array 'buf' declared here
>        char *p, buf[5];
>        ^
>    2 warnings generated.

That was discussed just days ago: C says that a pointer one past the end of the array is legal.  So here too it looks like Clang is wrong and GCC is right.

	paul

Re: [BUG] missing warning for pointer arithmetic out of bounds

[Alejandro Colomar]

[-- Attachment #1.1: Type: text/plain, Size: 1611 bytes --]

Hi Paul,

On 12/13/22 20:22, Paul Koning wrote:
> 
> 
>> On Dec 13, 2022, at 2:08 PM, Alejandro Colomar via Gcc <gcc@gcc.gnu.org> wrote:
>>
>> Hi!
>>
>> For the following program:
>>
>>
>>     $ cat buf.c
>>     #include <stdio.h>
>>
>>     int main(void)
>>     {
>>         char *p, buf[5];
>>
>>         p = buf + 6;
>>         printf("%p\n", p);
>>     }
>>
>>
>> There are no warnings in gcc, as I would expect:
>>
>>     $ gcc -Wall -Wextra buf.c -O0
>>
>> Clang does warn, however:
>>
>>     $ clang -Weverything -Wall -Wextra buf.c -O0
>>     buf.c:8:17: warning: format specifies type 'void *' but the argument has type 'char *' [-Wformat-pedantic]
>>         printf("%p\n", p);
>>                 ~~     ^
>>                 %s
>>     buf.c:7:6: warning: the pointer incremented by 6 refers past the end of the array (that contains 5 elements) [-Warray-bounds-pointer-arithmetic]
>>         p = buf + 6;
>>             ^     ~
> 
> I thought void * is a generic pointer that accepts any pointer argument.  So a warning about char* being passed in seems to be flat out wrong.
> 
>>     buf.c:5:2: note: array 'buf' declared here
>>         char *p, buf[5];
>>         ^
>>     2 warnings generated.
> 
> That was discussed just days ago: C says that a pointer one past the end of the array is legal.  So here too it looks like Clang is wrong and GCC is right.

Look again:

	char *p, buf[5];

	p = buf + 6;

That's a pointer two-past-the-end; not one.

That's UB.

Cheers,

Alex

> 
> 	paul
> 

-- 
<http://www.alejandro-colomar.es/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [BUG] missing warning for pointer arithmetic out of bounds

[Jonathan Wakely]

On Tue, 13 Dec 2022, 19:23 Paul Koning via Gcc, <gcc@gcc.gnu.org> wrote:
>
>
>
> > On Dec 13, 2022, at 2:08 PM, Alejandro Colomar via Gcc <gcc@gcc.gnu.org> wrote:
> >
> > Hi!
> >
> > For the following program:
> >
> >
> >    $ cat buf.c
> >    #include <stdio.h>
> >
> >    int main(void)
> >    {
> >        char *p, buf[5];
> >
> >        p = buf + 6;
> >        printf("%p\n", p);
> >    }
> >
> >
> > There are no warnings in gcc, as I would expect:
> >
> >    $ gcc -Wall -Wextra buf.c -O0
> >
> > Clang does warn, however:
> >
> >    $ clang -Weverything -Wall -Wextra buf.c -O0
> >    buf.c:8:17: warning: format specifies type 'void *' but the argument has type 'char *' [-Wformat-pedantic]
> >        printf("%p\n", p);
> >                ~~     ^
> >                %s
> >    buf.c:7:6: warning: the pointer incremented by 6 refers past the end of the array (that contains 5 elements) [-Warray-bounds-pointer-arithmetic]
> >        p = buf + 6;
> >            ^     ~
>
> I thought void * is a generic pointer that accepts any pointer argument.

Yes, but printf doesn't take a void* argument.

>
>   So a warning about char* being passed in seems to be flat out wrong.

I wouldn't say flat out wrong. It's wrong because the C standard
guarantees that void* and char* have the same representation and
alignment requirements, so no conversion is needed to pass a char*
through a varargs ellipsis where a void* is expected. But if it was
int* or struct X* then the warning would be correct (but not a problem
in practice on common arches, which is why Clang only enabels it with
-Wformat-pedantic).


>
> >    buf.c:5:2: note: array 'buf' declared here
> >        char *p, buf[5];
> >        ^
> >    2 warnings generated.
>
> That was discussed just days ago: C says that a pointer one past the end of the array is legal.  So here too it looks like Clang is wrong and GCC is right.


No, clang is totally right here.

Optimization levels for getting all warnings (was: [BUG] missing warning for pointer arithmetic out of bounds)

[Alejandro Colomar]

[-- Attachment #1.1: Type: text/plain, Size: 896 bytes --]

Hi Andrew

On 12/13/22 20:18, Andrew Pinski wrote:
[...]

> 
> GCC only warns during VRP which is only enabled at -O2:
> 
> <source>:8:12: warning: array subscript 6 is outside array bounds of
> 'char[5]' [-Warray-bounds=]
>      8 |          p = buf + 6;
>        |          ~~^~~~~~~~~
> <source>:6:19: note: at offset 6 into object 'buf' of size 5
>      6 |          char *p, buf[5];
>        |                   ^~~
> 
> Thanks,
> Andrew
> 

Makes sense.  I've seen some warnings that are disabled by optimization, and 
others that are enabled by it.

So, if I want to get all warnings that GCC can emit for any given software, is 
there a list of optimization levels on which I should compile?  Is -O0 and -O3 
enough for everything?  Or should I also build with all intermediate 
optimization levels?

Thanks

Alex

-- 
<http://www.alejandro-colomar.es/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]