[Bug c/88058] gcc fails to detect use of out of scope variable ?

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88058

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
ASAN can help in run-time:

$ cat pr88058.c
void g( char *a)
{
  *a = 'x';
}

void f( int n, char * p1)
{
        char * p2;

        p2 = p1;

        if (n >= 0)
        {
                char buf[ 10];

                p2 = buf;
        }
        g( p2);  // Bang !
}

int main()
{
  f(0, 0);
  return 0;
}

$ gcc pr88058.c -fsanitize=address &&  ./a.out 
=================================================================
==31750==ERROR: AddressSanitizer: stack-use-after-scope on address
0x7fffffffdb80 at pc 0x000000401182 bp 0x7fffffffdb10 sp 0x7fffffffdb08
WRITE of size 1 at 0x7fffffffdb80 thread T0
    #0 0x401181 in g (/home/marxin/Programming/testcases/a.out+0x401181)
    #1 0x401254 in f (/home/marxin/Programming/testcases/a.out+0x401254)
    #2 0x4012ba in main (/home/marxin/Programming/testcases/a.out+0x4012ba)
    #3 0x7ffff6c71fea in __libc_start_main ../csu/libc-start.c:308
    #4 0x401099 in _start (/home/marxin/Programming/testcases/a.out+0x401099)

Address 0x7fffffffdb80 is located in stack of thread T0 at offset 32 in frame
    #0 0x40119b in f (/home/marxin/Programming/testcases/a.out+0x40119b)

  This frame has 1 object(s):
    [32, 42) 'buf' <== Memory access at offset 32 is inside this variable
HINT: this may be a false positive if your program uses some custom stack
unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-scope
(/home/marxin/Programming/testcases/a.out+0x401181) in g
Shadow bytes around the buggy address:
  0x10007fff7b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7b60: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
=>0x10007fff7b70:[f8]f8 f2 f2 f3 f3 f3 f3 00 00 00 00 00 00 00 00
  0x10007fff7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7bc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==31750==ABORTING