https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109238
Bug ID: 109238
Summary: [13 Regression] tst-realloc.i:42:19: error: pointer
‘p’ may be used after ‘realloc’
[-Werror=use-after-free] in glibc tests
Product: gcc
Version: 13.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: tree-optimization
Assignee: unassigned at gcc dot gnu.org
Reporter: marxin at gcc dot gnu.org
CC: rguenth at gcc dot gnu.org
Target Milestone: ---
Created attachment 54723
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54723&action=edit
Unreduced test-case
It's the same issue as PR109170 this time in glibc's test-suite:
[ 1569s] gcc tst-realloc.c -c -std=gnu11 -fgnu89-inline -O2 -Wall
-funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection
-Werror=return-type -g -Wall -Wwrite-strings -Wundef -Werror
-fmerge-all-constants -frounding-math -fstack-protector-strong -fno-common
-Wstrict-prototypes -Wold-style-definition -fmath-errno -fPIE
-fcf-protection -I../include
-I/home/abuild/rpmbuild/BUILD/glibc-2.37.9000.180.g9e2ff880f3/cc-base/malloc
-I/home/abuild/rpmbuild/BUILD/glibc-2.37.9000.180.g9e2ff880f3/cc-base
-I../sysdeps/unix/sysv/linux/x86_64/64 -I../sysdeps/unix/sysv/linux/x86_64
-I../sysdeps/unix/sysv/linux/x86/include -I../sysdeps/unix/sysv/linux/x86
-I../sysdeps/x86/nptl -I../sysdeps/unix/sysv/linux/wordsize-64
-I../sysdeps/x86_64/nptl -I../sysdeps/unix/sysv/linux/include
-I../sysdeps/unix/sysv/linux -I../sysdeps/nptl -I../sysdeps/pthread
-I../sysdeps/gnu -I../sysdeps/unix/inet -I../sysdeps/unix/sysv
-I../sysdeps/unix/x86_64 -I../sysdeps/unix -I../sysdeps/posix
-I../sysdeps/x86_64/64 -I../sysdeps/x86_64/fpu/multiarch
-I../sysdeps/x86_64/fpu -I../sysdeps/x86/fpu -I../sysdeps/x86_64/multiarch
-I../sysdeps/x86_64 -I../sysdeps/x86/include -I../sysdeps/x86
-I../sysdeps/ieee754/float128 -I../sysdeps/ieee754/ldbl-96/include
-I../sysdeps/ieee754/ldbl-96 -I../sysdeps/ieee754/dbl-64
-I../sysdeps/ieee754/flt-32 -I../sysdeps/wordsize-64 -I../sysdeps/ieee754
-I../sysdeps/generic -I.. -I../libio -I. -D_LIBC_REENTRANT -include
/home/abuild/rpmbuild/BUILD/glibc-2.37.9000.180.g9e2ff880f3/cc-base/libc-modules.h
-DMODULE_NAME=testsuite -include ../include/libc-symbols.h -DPIC
-DTOP_NAMESPACE=glibc -DTEST_NO_MALLOPT -o
/home/abuild/rpmbuild/BUILD/glibc-2.37.9000.180.g9e2ff880f3/cc-base/malloc/tst-realloc.o
-MD -MP -MF
/home/abuild/rpmbuild/BUILD/glibc-2.37.9000.180.g9e2ff880f3/cc-base/malloc/tst-realloc.o.dt
-MT
/home/abuild/rpmbuild/BUILD/glibc-2.37.9000.180.g9e2ff880f3/cc-base/malloc/tst-realloc.o
[ 1569s] In function 'do_test',
[ 1569s] inlined from 'legacy_test_function' at ../test-skeleton.c:55:10:
[ 1569s] tst-realloc.c:135:7: error: pointer 'p' may be used after 'realloc'
[-Werror=use-after-free]
[ 1569s] 135 | p = realloc (p, 0);
[ 1569s] | ^~~~~~~~~~~~~~
[ 1569s] tst-realloc.c:117:7: note: call to 'realloc' here
[ 1569s] 117 | c = realloc (p, -1);
[ 1569s] | ^~~~~~~~~~~~~~~
[ 1569s] tst-realloc.c:127:12: error: pointer 'p' may be used after 'realloc'
[-Werror=use-after-free]
[ 1569s] 127 | if (c[i] != 0xff)
[ 1569s] | ^
[ 1569s] tst-realloc.c:117:7: note: call to 'realloc' here
[ 1569s] 117 | c = realloc (p, -1);
$ gcc tst-realloc.i -c -O2 -Wall -Werror
In function ‘do_test’,
inlined from ‘legacy_test_function’ at ../test-skeleton.c:55:10:
tst-realloc.c:135:7: error: pointer ‘p’ may be used after ‘realloc’
[-Werror=use-after-free]
tst-realloc.c:117:7: note: call to ‘realloc’ here
tst-realloc.c:127:12: error: pointer ‘p’ may be used after ‘realloc’
[-Werror=use-after-free]
tst-realloc.c:117:7: note: call to ‘realloc’ here
cc1: all warnings being treated as errors
