https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118721

            Bug ID: 118721
           Summary: &array[-1] not always detected with
                    -fsanitize=undefined
           Product: gcc
           Version: 15.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: pinskia at gcc dot gnu.org
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org
  Target Milestone: ---

Take:
```
int main(void) {
    char work[20] = {};
    char *b = work;
    b--;
    b[2] = 1;
    if (work[1] != 1)
      __builtin_trap();

    return 0;
}
```

GCC does not detect that after `b--;` b is no longer a valid pointer.

In the original testcase (PR 118720) `b--` is inside a function that gets
inlined.

Note clang also does not detect this but it looks like it is only GCC is where
the undefinedness matters (at least for PR 118720).
  • [Bug sanitizer/118721] New: &a... pinskia at gcc dot gnu.org via Gcc-bugs

Reply via email to