[BUG] missing warning for pointer arithmetic out of bounds

[BUG] missing warning for pointer arithmetic out of bounds

[Alejandro Colomar]

[-- Attachment #1.1: Type: text/plain, Size: 946 bytes --]

Hi!

For the following program:


     $ cat buf.c
     #include <stdio.h>

     int main(void)
     {
         char *p, buf[5];

         p = buf + 6;
         printf("%p\n", p);
     }


There are no warnings in gcc, as I would expect:

     $ gcc -Wall -Wextra buf.c -O0

Clang does warn, however:

     $ clang -Weverything -Wall -Wextra buf.c -O0
     buf.c:8:17: warning: format specifies type 'void *' but the argument has 
type 'char *' [-Wformat-pedantic]
         printf("%p\n", p);
                 ~~     ^
                 %s
     buf.c:7:6: warning: the pointer incremented by 6 refers past the end of the 
array (that contains 5 elements) [-Warray-bounds-pointer-arithmetic]
         p = buf + 6;
             ^     ~
     buf.c:5:2: note: array 'buf' declared here
         char *p, buf[5];
         ^
     2 warnings generated.

Cheers,

Alex


-- 
<http://www.alejandro-colomar.es/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [BUG] missing warning for pointer arithmetic out of bounds

[Alejandro Colomar]

[-- Attachment #1.1: Type: text/plain, Size: 1299 bytes --]



On 12/13/22 20:08, Alejandro Colomar wrote:
> Hi!
> 
> For the following program:
> 
> 
>      $ cat buf.c
>      #include <stdio.h>
> 
>      int main(void)
>      {
>          char *p, buf[5];
> 
>          p = buf + 6;
>          printf("%p\n", p);
>      }
> 
> 
> There are no warnings in gcc, as I would expect:

I just re-read my text, and it is ambiguous.  I meant that I expect warnings.


> 
>      $ gcc -Wall -Wextra buf.c -O0
> 
> Clang does warn, however:
> 
>      $ clang -Weverything -Wall -Wextra buf.c -O0
>      buf.c:8:17: warning: format specifies type 'void *' but the argument has 
> type 'char *' [-Wformat-pedantic]
>          printf("%p\n", p);
>                  ~~     ^
>                  %s
>      buf.c:7:6: warning: the pointer incremented by 6 refers past the end of the 
> array (that contains 5 elements) [-Warray-bounds-pointer-arithmetic]
>          p = buf + 6;
>              ^     ~
>      buf.c:5:2: note: array 'buf' declared here
>          char *p, buf[5];
>          ^
>      2 warnings generated.
> 
> Cheers,
> 
> Alex
> 
> 

-- 
<http://www.alejandro-colomar.es/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [BUG] missing warning for pointer arithmetic out of bounds

[Andrew Pinski]

On Tue, Dec 13, 2022 at 11:16 AM Alejandro Colomar via Gcc
<gcc@gcc.gnu.org> wrote:
>
>
>
> On 12/13/22 20:08, Alejandro Colomar wrote:
> > Hi!
> >
> > For the following program:
> >
> >
> >      $ cat buf.c
> >      #include <stdio.h>
> >
> >      int main(void)
> >      {
> >          char *p, buf[5];
> >
> >          p = buf + 6;
> >          printf("%p\n", p);
> >      }
> >
> >
> > There are no warnings in gcc, as I would expect:
>
> I just re-read my text, and it is ambiguous.  I meant that I expect warnings.

GCC only warns during VRP which is only enabled at -O2:

<source>:8:12: warning: array subscript 6 is outside array bounds of
'char[5]' [-Warray-bounds=]
    8 |          p = buf + 6;
      |          ~~^~~~~~~~~
<source>:6:19: note: at offset 6 into object 'buf' of size 5
    6 |          char *p, buf[5];
      |                   ^~~

Thanks,
Andrew


>
>
> >
> >      $ gcc -Wall -Wextra buf.c -O0
> >
> > Clang does warn, however:
> >
> >      $ clang -Weverything -Wall -Wextra buf.c -O0
> >      buf.c:8:17: warning: format specifies type 'void *' but the argument has
> > type 'char *' [-Wformat-pedantic]
> >          printf("%p\n", p);
> >                  ~~     ^
> >                  %s
> >      buf.c:7:6: warning: the pointer incremented by 6 refers past the end of the
> > array (that contains 5 elements) [-Warray-bounds-pointer-arithmetic]
> >          p = buf + 6;
> >              ^     ~
> >      buf.c:5:2: note: array 'buf' declared here
> >          char *p, buf[5];
> >          ^
> >      2 warnings generated.
> >
> > Cheers,
> >
> > Alex
> >
> >
>
> --
> <http://www.alejandro-colomar.es/>

Optimization levels for getting all warnings (was: [BUG] missing warning for pointer arithmetic out of bounds)

[Alejandro Colomar]

[-- Attachment #1.1: Type: text/plain, Size: 896 bytes --]

Hi Andrew

On 12/13/22 20:18, Andrew Pinski wrote:
[...]

> 
> GCC only warns during VRP which is only enabled at -O2:
> 
> <source>:8:12: warning: array subscript 6 is outside array bounds of
> 'char[5]' [-Warray-bounds=]
>      8 |          p = buf + 6;
>        |          ~~^~~~~~~~~
> <source>:6:19: note: at offset 6 into object 'buf' of size 5
>      6 |          char *p, buf[5];
>        |                   ^~~
> 
> Thanks,
> Andrew
> 

Makes sense.  I've seen some warnings that are disabled by optimization, and 
others that are enabled by it.

So, if I want to get all warnings that GCC can emit for any given software, is 
there a list of optimization levels on which I should compile?  Is -O0 and -O3 
enough for everything?  Or should I also build with all intermediate 
optimization levels?

Thanks

Alex

-- 
<http://www.alejandro-colomar.es/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [BUG] missing warning for pointer arithmetic out of bounds

[David Malcolm]

On Tue, 2022-12-13 at 20:15 +0100, Alejandro Colomar via Gcc wrote:
> 
> 
> On 12/13/22 20:08, Alejandro Colomar wrote:
> > Hi!
> > 
> > For the following program:
> > 
> > 
> >      $ cat buf.c
> >      #include <stdio.h>
> > 
> >      int main(void)
> >      {
> >          char *p, buf[5];
> > 
> >          p = buf + 6;
> >          printf("%p\n", p);
> >      }
> > 
> > 
> > There are no warnings in gcc, as I would expect:
> 
> I just re-read my text, and it is ambiguous.  I meant that I expect
> warnings.

Yeah, it would be good to warn about such code.

Looking in bugzilla, I see:
  https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81172
which seems to talk about this issue, but that bug was closed as
resolved on 2020-04-13; I'm not sure what happened here.

Dave


> 
> 
> > 
> >      $ gcc -Wall -Wextra buf.c -O0
> > 
> > Clang does warn, however:
> > 
> >      $ clang -Weverything -Wall -Wextra buf.c -O0
> >      buf.c:8:17: warning: format specifies type 'void *' but the
> > argument has 
> > type 'char *' [-Wformat-pedantic]
> >          printf("%p\n", p);
> >                  ~~     ^
> >                  %s
> >      buf.c:7:6: warning: the pointer incremented by 6 refers past
> > the end of the 
> > array (that contains 5 elements) [-Warray-bounds-pointer-
> > arithmetic]
> >          p = buf + 6;
> >              ^     ~
> >      buf.c:5:2: note: array 'buf' declared here
> >          char *p, buf[5];
> >          ^
> >      2 warnings generated.
> > 
> > Cheers,
> > 
> > Alex
> > 
> > 
> 
> -- 
> <http://www.alejandro-colomar.es/>

Re: [BUG] missing warning for pointer arithmetic out of bounds

[Paul Koning]

> On Dec 13, 2022, at 2:08 PM, Alejandro Colomar via Gcc <gcc@gcc.gnu.org> wrote:
> 
> Hi!
> 
> For the following program:
> 
> 
>    $ cat buf.c
>    #include <stdio.h>
> 
>    int main(void)
>    {
>        char *p, buf[5];
> 
>        p = buf + 6;
>        printf("%p\n", p);
>    }
> 
> 
> There are no warnings in gcc, as I would expect:
> 
>    $ gcc -Wall -Wextra buf.c -O0
> 
> Clang does warn, however:
> 
>    $ clang -Weverything -Wall -Wextra buf.c -O0
>    buf.c:8:17: warning: format specifies type 'void *' but the argument has type 'char *' [-Wformat-pedantic]
>        printf("%p\n", p);
>                ~~     ^
>                %s
>    buf.c:7:6: warning: the pointer incremented by 6 refers past the end of the array (that contains 5 elements) [-Warray-bounds-pointer-arithmetic]
>        p = buf + 6;
>            ^     ~

I thought void * is a generic pointer that accepts any pointer argument.  So a warning about char* being passed in seems to be flat out wrong.

>    buf.c:5:2: note: array 'buf' declared here
>        char *p, buf[5];
>        ^
>    2 warnings generated.

That was discussed just days ago: C says that a pointer one past the end of the array is legal.  So here too it looks like Clang is wrong and GCC is right.

	paul

Re: [BUG] missing warning for pointer arithmetic out of bounds

[Alejandro Colomar]

[-- Attachment #1.1: Type: text/plain, Size: 1611 bytes --]

Hi Paul,

On 12/13/22 20:22, Paul Koning wrote:
> 
> 
>> On Dec 13, 2022, at 2:08 PM, Alejandro Colomar via Gcc <gcc@gcc.gnu.org> wrote:
>>
>> Hi!
>>
>> For the following program:
>>
>>
>>     $ cat buf.c
>>     #include <stdio.h>
>>
>>     int main(void)
>>     {
>>         char *p, buf[5];
>>
>>         p = buf + 6;
>>         printf("%p\n", p);
>>     }
>>
>>
>> There are no warnings in gcc, as I would expect:
>>
>>     $ gcc -Wall -Wextra buf.c -O0
>>
>> Clang does warn, however:
>>
>>     $ clang -Weverything -Wall -Wextra buf.c -O0
>>     buf.c:8:17: warning: format specifies type 'void *' but the argument has type 'char *' [-Wformat-pedantic]
>>         printf("%p\n", p);
>>                 ~~     ^
>>                 %s
>>     buf.c:7:6: warning: the pointer incremented by 6 refers past the end of the array (that contains 5 elements) [-Warray-bounds-pointer-arithmetic]
>>         p = buf + 6;
>>             ^     ~
> 
> I thought void * is a generic pointer that accepts any pointer argument.  So a warning about char* being passed in seems to be flat out wrong.
> 
>>     buf.c:5:2: note: array 'buf' declared here
>>         char *p, buf[5];
>>         ^
>>     2 warnings generated.
> 
> That was discussed just days ago: C says that a pointer one past the end of the array is legal.  So here too it looks like Clang is wrong and GCC is right.

Look again:

	char *p, buf[5];

	p = buf + 6;

That's a pointer two-past-the-end; not one.

That's UB.

Cheers,

Alex

> 
> 	paul
> 

-- 
<http://www.alejandro-colomar.es/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [BUG] missing warning for pointer arithmetic out of bounds

[Jonathan Wakely]

On Tue, 13 Dec 2022, 19:23 Paul Koning via Gcc, <gcc@gcc.gnu.org> wrote:
>
>
>
> > On Dec 13, 2022, at 2:08 PM, Alejandro Colomar via Gcc <gcc@gcc.gnu.org> wrote:
> >
> > Hi!
> >
> > For the following program:
> >
> >
> >    $ cat buf.c
> >    #include <stdio.h>
> >
> >    int main(void)
> >    {
> >        char *p, buf[5];
> >
> >        p = buf + 6;
> >        printf("%p\n", p);
> >    }
> >
> >
> > There are no warnings in gcc, as I would expect:
> >
> >    $ gcc -Wall -Wextra buf.c -O0
> >
> > Clang does warn, however:
> >
> >    $ clang -Weverything -Wall -Wextra buf.c -O0
> >    buf.c:8:17: warning: format specifies type 'void *' but the argument has type 'char *' [-Wformat-pedantic]
> >        printf("%p\n", p);
> >                ~~     ^
> >                %s
> >    buf.c:7:6: warning: the pointer incremented by 6 refers past the end of the array (that contains 5 elements) [-Warray-bounds-pointer-arithmetic]
> >        p = buf + 6;
> >            ^     ~
>
> I thought void * is a generic pointer that accepts any pointer argument.

Yes, but printf doesn't take a void* argument.

>
>   So a warning about char* being passed in seems to be flat out wrong.

I wouldn't say flat out wrong. It's wrong because the C standard
guarantees that void* and char* have the same representation and
alignment requirements, so no conversion is needed to pass a char*
through a varargs ellipsis where a void* is expected. But if it was
int* or struct X* then the warning would be correct (but not a problem
in practice on common arches, which is why Clang only enabels it with
-Wformat-pedantic).


>
> >    buf.c:5:2: note: array 'buf' declared here
> >        char *p, buf[5];
> >        ^
> >    2 warnings generated.
>
> That was discussed just days ago: C says that a pointer one past the end of the array is legal.  So here too it looks like Clang is wrong and GCC is right.


No, clang is totally right here.