https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95667
Bug ID: 95667
Summary: warning for memset writing across multiple members
Product: gcc
Version: 10.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: middle-end
Assignee: unassigned at gcc dot gnu.org
Reporter: msebor at gcc dot gnu.org
Target Milestone: ---
Although strictly correct, GCC usually avoids warning for calls to memcpy that
write into multiple members at the same time, up to the size of the complete
object. This is done because the Linux kernel does these things in a few
places. As dangerous as the practice is, the change committed to resolve
pr95353 (r11-1183) tried to preserve this behavior for now (in the future I'd
like to add a new warning option to control it), but the test case below shows
it didn't preserve the GCC 10 and prior behavior in this case (same with
memcpy).
$ cat z.c && gcc -O2 -S -Wall -Wextra -fdump-tree-optimized=/dev/stdout z.c
struct S { char a[3], b[5]; };
void* f (void)
{
struct S *p = __builtin_malloc (sizeof *p);
char s[] = "1234567";
__builtin_strcpy (p->a, s); // warning (good)
return p;
}
void* g (void)
{
struct S *p = __builtin_malloc (sizeof *p);
__builtin_memset (p->a, 0, 8); // warning not expected (yet)
return p;
}
z.c: In function ‘f’:
z.c:7:3: warning: ‘__builtin_strcpy’ writing 8 bytes into a region of size 3
[-Wstringop-overflow=]
7 | __builtin_strcpy (p->a, s); // warning (good)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
z.c:1:17: note: at offset 0 to object ‘a’ with size 3 declared here
1 | struct S { char a[3], b[5]; };
| ^
;; Function f (f, funcdef_no=0, decl_uid=1934, cgraph_uid=1, symbol_order=0)
f ()
{
char s[8];
struct S * p;
long unsigned int _8;
<bb 2> [local count: 1073741824]:
p_4 = __builtin_malloc (8);
s = "1234567";
_8 = MEM <long unsigned int> [(char * {ref-all})&s];
MEM <long unsigned int> [(char * {ref-all})p_4] = _8;
s ={v} {CLOBBER};
return p_4;
}
;; Function g (g, funcdef_no=1, decl_uid=1939, cgraph_uid=2, symbol_order=1)
g ()
{
struct S * p;
char[3] * _1;
<bb 2> [local count: 1073741824]:
p_4 = __builtin_malloc (8);
_1 = &p_4->a;
__builtin_memset (_1, 0, 8);
return p_4;
}
z.c: In function ‘g’:
z.c:14:3: warning: ‘__builtin_memset’ writing 8 bytes into a region of size 3
overflows the destination [-Wstringop-overflow=]
14 | __builtin_memset (p->a, 0, 8); // warning not expected (yet)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
z.c:1:17: note: destination object ‘a’
1 | struct S { char a[3], b[5]; };
| ^
