https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109990
--- Comment #5 from Bruno Haible <bruno at clisp dot org> --- Created attachment 55170 --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55170&action=edit test case bar2.c Find attached a modified test case. I changed the code to map[i].alias = new_pool + (map[i].alias - string_space); map[i].value = new_pool + (map[i].value - string_space); so that it subtracts pointers into the old string_space, producing an integer, and adding that integer to new_pool. It produces the same warning (even twice, apparently because there is no common subexpression between the two lines any more): $ gcc -Wall -O2 -S bar2.c bar2.c: In function ‘read_alias_file’: bar2.c:123:67: warning: pointer may be used after ‘realloc’ [-Wuse-after-free] 123 | map[i].value = new_pool + (map[i].value - string_space); | ~~~~~~~~~~~~~~^~~~~~~~~~~~~~~ bar2.c:114:45: note: call to ‘realloc’ here 114 | char *new_pool = (char *) realloc (string_space, new_size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ bar2.c:122:67: warning: pointer may be used after ‘realloc’ [-Wuse-after-free] 122 | map[i].alias = new_pool + (map[i].alias - string_space); | ~~~~~~~~~~~~~~^~~~~~~~~~~~~~~ bar2.c:114:45: note: call to ‘realloc’ here 114 | char *new_pool = (char *) realloc (string_space, new_size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
