diff options
| author | David Malcolm <dmalcolm@redhat.com> | 2024-05-09 13:09:28 -0400 |
|---|---|---|
| committer | David Malcolm <dmalcolm@redhat.com> | 2024-05-09 13:09:28 -0400 |
| commit | 0df1ee083434ac00ecb19582b1e5b25e105981b2 (patch) | |
| tree | 773a2ba5025f7554f56dcec9ef4c56eb033b6673 /gcc | |
| parent | 60dcb710b6b4aa22ea96abc8df6dfe9067f3d7fe (diff) | |
| download | gcc-0df1ee083434ac00ecb19582b1e5b25e105981b2.zip gcc-0df1ee083434ac00ecb19582b1e5b25e105981b2.tar.gz gcc-0df1ee083434ac00ecb19582b1e5b25e105981b2.tar.bz2 | |
analyzer: fix ICE on division of tainted floating-point values [PR110700]
gcc/analyzer/ChangeLog:
PR analyzer/110700
* region-model-manager.cc
(region_model_manager::get_or_create_int_cst): Assert that we have
an integral or pointer type.
* sm-taint.cc (taint_state_machine::check_for_tainted_divisor):
Don't check non-integral types.
gcc/testsuite/ChangeLog:
PR analyzer/110700
* gcc.dg/analyzer/taint-divisor-2.c: New test.
(cherry picked from commit r14-2658-gb86c0fe327a519)
Signed-off-by: David Malcolm <dmalcolm@redhat.com>
Diffstat (limited to 'gcc')
| -rw-r--r-- | gcc/analyzer/region-model-manager.cc | 3 | ||||
| -rw-r--r-- | gcc/analyzer/sm-taint.cc | 6 | ||||
| -rw-r--r-- | gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c | 13 |
3 files changed, 21 insertions, 1 deletions
diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc index fab5bba..1a9886f 100644 --- a/gcc/analyzer/region-model-manager.cc +++ b/gcc/analyzer/region-model-manager.cc @@ -233,7 +233,8 @@ const svalue * region_model_manager::get_or_create_int_cst (tree type, poly_int64 val) { gcc_assert (type); - tree tree_cst = build_int_cst (type, val); + gcc_assert (INTEGRAL_TYPE_P (type) || POINTER_TYPE_P (type)); + tree tree_cst = wide_int_to_tree (type, val); return get_or_create_constant_svalue (tree_cst); } diff --git a/gcc/analyzer/sm-taint.cc b/gcc/analyzer/sm-taint.cc index f72f194..7bce3ef 100644 --- a/gcc/analyzer/sm-taint.cc +++ b/gcc/analyzer/sm-taint.cc @@ -1344,6 +1344,12 @@ taint_state_machine::check_for_tainted_divisor (sm_context *sm_ctxt, return; tree divisor_expr = gimple_assign_rhs2 (assign);; + + /* Until we track conditions on floating point values, we can't check to + see if they've been checked against zero. */ + if (!INTEGRAL_TYPE_P (TREE_TYPE (divisor_expr))) + return; + const svalue *divisor_sval = old_model->get_rvalue (divisor_expr, NULL); state_t state = sm_ctxt->get_state (assign, divisor_sval); diff --git a/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c b/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c new file mode 100644 index 0000000..de9a1cb --- /dev/null +++ b/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c @@ -0,0 +1,13 @@ +// TODO: remove need for this option: +/* { dg-additional-options "-fanalyzer-checker=taint" } */ + +#include "analyzer-decls.h" + +__attribute__ ((tainted_args)) +double pr110700 (double x, double y) +{ + /* Ideally we'd complain here with -Wanalyzer-tainted-divisor, but + until we track conditions on floating point values, we can't check to + see if they've been checked against zero. */ + return x / y; +} |