aboutsummaryrefslogtreecommitdiff
path: root/gcc
diff options
context:
space:
mode:
authorTim Lange <mail@tim-lange.me>2022-09-10 23:53:48 +0200
committerTim Lange <mail@tim-lange.me>2022-09-11 23:55:20 +0200
commit0ea5e3f4542832b8da016b152695e64a2a386309 (patch)
tree37e285532e7f807019eae14d388dbbedbea5155c /gcc
parent5b3496e2ea632463f4118928a87639454c87a859 (diff)
downloadgcc-0ea5e3f4542832b8da016b152695e64a2a386309.zip
gcc-0ea5e3f4542832b8da016b152695e64a2a386309.tar.gz
gcc-0ea5e3f4542832b8da016b152695e64a2a386309.tar.bz2
analyzer: consider empty ranges and zero byte accesses [PR106845]
This patch adds handling of empty ranges in bit_range and byte_range and adds an assertion to member functions that assume a positive size. Further, the patch fixes an ICE caused by an empty byte_range passed to byte_range::exceeds_p. Regression-tested on Linux x86_64. 2022-09-10 Tim Lange <mail@tim-lange.me> gcc/analyzer/ChangeLog: PR analyzer/106845 * region-model.cc (region_model::check_region_bounds): Bail out if 0 bytes were accessed. * store.cc (byte_range::dump_to_pp): Add special case for empty ranges. (byte_range::exceeds_p): Restrict to non-empty ranges. (byte_range::falls_short_of_p): Restrict to non-empty ranges. * store.h (bit_range::empty_p): New function. (bit_range::get_last_byte_offset): Restrict to non-empty ranges. (byte_range::empty_p): New function. (byte_range::get_last_byte_offset): Restrict to non-empty ranges. gcc/testsuite/ChangeLog: PR analyzer/106845 * gcc.dg/analyzer/out-of-bounds-zero.c: New test. * gcc.dg/analyzer/pr106845.c: New test.
Diffstat (limited to 'gcc')
-rw-r--r--gcc/analyzer/region-model.cc3
-rw-r--r--gcc/analyzer/store.cc12
-rw-r--r--gcc/analyzer/store.h12
-rw-r--r--gcc/testsuite/gcc.dg/analyzer/out-of-bounds-zero.c67
-rw-r--r--gcc/testsuite/gcc.dg/analyzer/pr106845.c11
5 files changed, 103 insertions, 2 deletions
diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc
index 6eeb684..13b8e3e 100644
--- a/gcc/analyzer/region-model.cc
+++ b/gcc/analyzer/region-model.cc
@@ -1828,6 +1828,9 @@ region_model::check_region_bounds (const region *reg,
/* Find out how many bytes were accessed. */
const svalue *num_bytes_sval = reg->get_byte_size_sval (m_mgr);
tree num_bytes_tree = maybe_get_integer_cst_tree (num_bytes_sval);
+ /* Bail out if 0 bytes are accessed. */
+ if (num_bytes_tree && zerop (num_bytes_tree))
+ return;
/* Get the capacity of the buffer. */
const svalue *capacity = get_capacity (base_reg);
diff --git a/gcc/analyzer/store.cc b/gcc/analyzer/store.cc
index ec5232c..1857d95 100644
--- a/gcc/analyzer/store.cc
+++ b/gcc/analyzer/store.cc
@@ -380,7 +380,11 @@ bit_range::as_byte_range (byte_range *out) const
void
byte_range::dump_to_pp (pretty_printer *pp) const
{
- if (m_size_in_bytes == 1)
+ if (m_size_in_bytes == 0)
+ {
+ pp_string (pp, "empty");
+ }
+ else if (m_size_in_bytes == 1)
{
pp_string (pp, "byte ");
pp_wide_int (pp, m_start_byte_offset, SIGNED);
@@ -455,7 +459,9 @@ bool
byte_range::exceeds_p (const byte_range &other,
byte_range *out_overhanging_byte_range) const
{
- if (other.get_last_byte_offset () < get_last_byte_offset ())
+ gcc_assert (!empty_p ());
+
+ if (other.get_next_byte_offset () < get_next_byte_offset ())
{
/* THIS definitely exceeds OTHER. */
byte_offset_t start = MAX (get_start_byte_offset (),
@@ -477,6 +483,8 @@ bool
byte_range::falls_short_of_p (byte_offset_t offset,
byte_range *out_fall_short_bytes) const
{
+ gcc_assert (!empty_p ());
+
if (get_start_byte_offset () < offset)
{
/* THIS falls short of OFFSET. */
diff --git a/gcc/analyzer/store.h b/gcc/analyzer/store.h
index ac8b685..d172ee75 100644
--- a/gcc/analyzer/store.h
+++ b/gcc/analyzer/store.h
@@ -237,6 +237,11 @@ struct bit_range
void dump_to_pp (pretty_printer *pp) const;
void dump () const;
+ bool empty_p () const
+ {
+ return m_size_in_bits == 0;
+ }
+
bit_offset_t get_start_bit_offset () const
{
return m_start_bit_offset;
@@ -247,6 +252,7 @@ struct bit_range
}
bit_offset_t get_last_bit_offset () const
{
+ gcc_assert (!empty_p ());
return get_next_bit_offset () - 1;
}
@@ -297,6 +303,11 @@ struct byte_range
void dump_to_pp (pretty_printer *pp) const;
void dump () const;
+ bool empty_p () const
+ {
+ return m_size_in_bytes == 0;
+ }
+
bool contains_p (byte_offset_t offset) const
{
return (offset >= get_start_byte_offset ()
@@ -329,6 +340,7 @@ struct byte_range
}
byte_offset_t get_last_byte_offset () const
{
+ gcc_assert (!empty_p ());
return m_start_byte_offset + m_size_in_bytes - 1;
}
diff --git a/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-zero.c b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-zero.c
new file mode 100644
index 0000000..201ca00
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/out-of-bounds-zero.c
@@ -0,0 +1,67 @@
+/* { dg-additional-options "-Wno-stringop-overflow"} */
+/* -Wstringop-overflow= triggers on test5. */
+
+#include <stdint.h>
+#include <stdlib.h>
+
+void test1 (void)
+{
+ int32_t buf[1];
+ /* Zero bytes written on non-zero allocation. */
+ __builtin_memset (buf, 0, 0);
+}
+
+void test2 (void)
+{
+ /* ISO C forbids zero-size arrays but GCC compiles this to an
+ zero-sized array without -Wpedantic. */
+ int32_t buf[0];
+ /* Write on zero capacity. */
+ __builtin_memset (buf, 0, sizeof (int32_t)); /* { dg-line test2 } */
+
+ /* { dg-warning "overflow" "warning" { target *-*-* } test2 } */
+ /* { dg-message "from byte 0 till byte 3" "final event" { target *-*-* } test2 } */
+}
+
+void test3 (void)
+{
+ int32_t buf[0];
+ /* Zero bytes written on zero capacity. */
+ __builtin_memset (buf, 0, 0);
+}
+
+void test4 (void)
+{
+ int32_t *buf = malloc (sizeof (int32_t));
+ if (!buf)
+ return;
+
+ /* Zero bytes written on non-zero allocation. */
+ __builtin_memset (buf, 0, 0);
+ free (buf);
+}
+
+void test5 (void)
+{
+ int32_t *buf = malloc (0);
+ if (!buf)
+ return;
+
+ /* Write on zero capacity. */
+ __builtin_memset (buf, 0, sizeof (int32_t)); /* { dg-line test5 } */
+ free (buf);
+
+ /* { dg-warning "overflow" "warning" { target *-*-* } test5 } */
+ /* { dg-message "from byte 0 till byte 3" "final event" { target *-*-* } test5 } */
+}
+
+void test6 (void)
+{
+ int32_t *buf = malloc (0);
+ if (!buf)
+ return;
+
+ /* Zero bytes written on zero capacity. */
+ __builtin_memset (buf, 0, 0);
+ free (buf);
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr106845.c b/gcc/testsuite/gcc.dg/analyzer/pr106845.c
new file mode 100644
index 0000000..528c7b3
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/pr106845.c
@@ -0,0 +1,11 @@
+int buf_size;
+
+int
+main (void)
+{
+ char buf[buf_size];
+
+ __builtin_memset (&buf[1], 0, buf_size);
+
+ return 0;
+}