[Bug build/26779] New: benign use after realloc at localealias.c:329

["msebor at gmail dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=26779

            Bug ID: 26779
           Summary: benign use after realloc at localealias.c:329
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: build
          Assignee: unassigned at sourceware dot org
          Reporter: msebor at gmail dot com
                CC: carlos at redhat dot com
  Target Milestone: ---

Testing a GCC 11 enhancement to detect invalid uses of freed pointers exposes
the following (benign) bug in localealias.  A successful call to realloc
renders its argument indeterminate, even when it doesn't result in moving the
object.  The affected code uses the indeterminate pointer to detect whether the
call resulted in moving the object.  Converting the pointers to intptr_t and
performing the equality test on those avoids the warning.

                      char *new_pool = (char *) realloc (string_space,
new_size);
                      if (new_pool == NULL)
                        goto out;

                      if (__builtin_expect (string_space != new_pool, 0))

and the warning is:

localealias.c: In function ‘read_alias_file’:
localealias.c:329:58: warning: statement uses a freed pointer
[-Wuse-after-free=]
  329 |                       if (__builtin_expect (string_space != new_pool,
0))
      |                                             ~~~~~~~~~~~~~^~~~~~~~~~~
localealias.c:325:49: note: freed by ‘realloc’ here
  325 |                       char *new_pool = (char *) realloc (string_space,
new_size);
      |                                                
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
localealias.c:329:26: warning: statement uses a freed pointer
[-Wuse-after-free=]
  329 |                       if (__builtin_expect (string_space != new_pool,
0))
      |                          ^
localealias.c:325:49: note: freed by ‘realloc’ here
  325 |                       char *new_pool = (char *) realloc (string_space,
new_size);
      |                                                
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-- 
You are receiving this mail because:
You are on the CC list for the bug.