[Bug build/26874] New: -Warray-bounds in _IO_wdefault_doallocate

["msebor at gmail dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=26874

            Bug ID: 26874
           Summary: -Warray-bounds in _IO_wdefault_doallocate
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: build
          Assignee: unassigned at sourceware dot org
          Reporter: msebor at gmail dot com
                CC: carlos at redhat dot com
  Target Milestone: ---

A recent Glibc build with an experimental version GCC 11 with some
-Warray-bounds enhancements shows the warning below:

wgenops.c: In function ‘_IO_wdefault_doallocate’:
wgenops.c:387:3: warning: array subscript 8192 is outside array bounds of
‘wchar_t[2048]’ {aka ‘int[2048]’} [-Warray-bounds]
  387 |   _IO_wsetb (fp, buf, buf + BUFSIZ, 1);
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
wgenops.c:384:9: note: at offset 32768 into source object of size 8192
allocated by ‘malloc’
  384 |   buf = malloc (BUFSIZ);
      |         ^~~~~~~~~~~~~~~

The warning looks justified to me.  The function allocates BUFSIZ bytes but
then increments the wchar_t* pointer to it by the same number, failing to take
into account the scaling by sizeof (wchar_t):

int
_IO_wdefault_doallocate (FILE *fp)
{
  wchar_t *buf;

  buf = malloc (BUFSIZ);
  if (__glibc_unlikely (buf == NULL))
    return EOF;
  _IO_wsetb (fp, buf, buf + BUFSIZ, 1);
  return 1;
}

I'd say either the malloc argument should be scaled up or the pointer increment
scaled down.

-- 
You are receiving this mail because:
You are on the CC list for the bug.