https://gcc.gnu.org/bugzilla/show_bug.cgi?id=89427
--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
The equivalent code using memcpy (or even strcpy) is diagnosed:
$ cat u.c && gcc -O2 -S -Wall u.c
char a[8];
void f (int i)
{
char *p = a + sizeof a;
if (i < 5)
i = 5;
__builtin_memcpy (p + i, "", 1);
}
u.c: In function ‘f’:
u.c:8:3: warning: ‘__builtin_memcpy’ offset [13, 2147483655] is out of the
bounds [0, 8] of object ‘a’ with type ‘char[8]’ [-Warray-bounds]
8 | __builtin_memcpy (p + i, "", 1);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
u.c:1:6: note: ‘a’ declared here
1 | char a[8];
| ^
Likewise for memset (by -Wstringop-overflow=):
$ cat u.c && gcc -O2 -S -Wall u.c
char a[8];
void f (int i)
{
char *p = a + sizeof a;
if (i < 5)
i = 5;
__builtin_memset (p + i, 0, 1);
}
u.c: In function ‘f’:
u.c:8:3: warning: ‘__builtin_memset’ writing 1 byte into a region of size 0
overflows the destination [-Wstringop-overflow=]
8 | __builtin_memset (p + i, 0, 1);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
