On 9/10/19 4:35 PM, Jeff Law wrote:
On 9/6/19 1:27 PM, Martin Sebor wrote:
Recent enhancements to -Wstringop-overflow improved the warning
to the point that it detects a superset of the problems -Warray-
bounds is intended detect in character accesses. Because both
warnings detect overlapping sets of problems, and because the IL
they work with tends to change in subtle ways from target to
targer, tests designed to verify one or the other sometimes fail
with a target where the warning isn't robust enough to detect
the problem given the IL representation.
To reduce these test suite failures the attached patch extends
-Warray-bounds to handle some of the same problems -Wstringop-
overflow does, pecifically, out-of-bounds accesses to array
members of structs, including zero-length arrays and flexible
array members of defined objects.
In the process of testing the enhancement I realized that
the recently added component_size() function doesn't work as
intended for non-character array members (see below). The patch
corrects this by reverting back to the original implementation
of the function until the better/simpler solution can be put in
place as mentioned below.
Tested on x86_64-linux.
Martin
[*] component_size() happens to work for char arrays because those
are transformed to STRING_CSTs, but not for arrays that are not.
E.g., in
struct S { int64_t i; int16_t j; int16_t a[]; }
s = { 0, 0, { 1, 0 } };
unless called with type set to int16_t[2], fold_ctor_reference
will return s.a[0] rather than all of s.a. But set type to
int16_t[2] we would need to know that s.a's initializer has two
elements, and that's just what we're using fold_ctor_reference
to find out.
I think this could probably be made to work somehow by extending
useless_type_conversion_p to handle this case as special somehow,
but it doesn't seem worth the effort given that there should be
an easier way to do it as you noted below.
Given the above, the long term solution should be to rely on
DECL_SIZE_UNIT(decl) - TYPE_SIZE_UNIT(decl_type) as Richard
suggested in the review of its initial implementation.
Unfortunately, because of bugs in both the C and C++ front ends
(I just opened PR 65403 with the details) the simple formula
doesn't give the right answers either. So until the bugs are
fixed, the patch reverts back to the original loopy solution.
It's no more costly than the current fold_ctor_reference
approach.
...
So no concerns with the patch itself, just the fallout you mentioned in
a follow-up message. Ideally we'd have glibc and the kernel fixed
before this goes in, but I'd settle for just getting glibc fixed since
we have more influence there.
Half of the issues there were due to a bug in the warning. The rest
are caused by Glibc's use of interior zero-length arrays to access
subsequent members. It works in simple cases but it's very brittle
because GCC assumes that even such members don't alias. If it's meant
to be a supported feature then aliasing would have to be changed to
take it into account. But I'd rather encourage projects to move away
from these dangerous hacks and towards cleaner, safer code.
I've fixed the bug in the attached patch. The rest can be suppressed
by replacing the zero-length arrays with flexible array members but
that's just trading one misuse for another. If the code can't be
changed to avoid this (likely not an option since the arrays are in
visible in the public API) I think the best way to deal with them is
to suppress them by #pragma GCC diagnostic ignored. I opened BZ 25097
in Glibc Bugzilla to track this.
Out of curiosity are the kernel issues you raised due to flexible arrays
or just cases where we're doing a better job on normal objects? I'd be
a bit surprised to find flexible arrays in the kernel.
I don't think I've come across any flexible arrays in the kernel.
The patch triggers 94 instances of -Warray-bounds (60 of which
are for distinct code) in 21 .c files. I haven't looked at all
of them but some of the patterns I noticed are:
1) Intentionally using an interior zero-length array to access
(e.g., memset) one or more subsequent members. E.g.,
_dbgp_external_startup in drivers/usb/early/ehci-dbgp.c and
quite a few others. This is pretty pervasive but seems easily
avoidable.
2) Overwriting a member array with more data (e.g., function
cxio_rdev_open in
drivers/infiniband/hw/cxgb3/cxio_hal.c or in function
pk_probe in drivers/hid/hid-prodikeys.c). At first glance
some of these look like bugs but with stuff obscured by macros
and no comments it's hard to tell.
3) Uses of the container_of() macro to access one member given
the address of another. This is undefined (and again breaks
the aliasing rules) but the macro is used all over the place
in the kernel. I count over 15,000 references to it.
4) Uses of one-element arrays as members of other one-element
arrays (in include/scsi/fc/fc_ms.h). Was this ever meant
to be supported by GCC? (It isn't by _FORTIFY_SOURCE=2.)
5) Possible false positives due to the recent loop unrolling
change.
It will be a quite a bit of work to clean this up. To make it
easier we would introduce a new option to control the warning
for some of the most common idioms, such as
-Wzero-length-array-bounds. I'm not too wild about this because
it would just paper over the problem. A better solution would
also involve avoiding the aliasing assumptions for overlapping
zero-length member arrays.
Anyway, attached is the updated patch with just the one fix
I mentioned above, retested on x86_64-linux.
Martin
PR middle-end/91679 - missing -Warray-bounds accessing a member array in a local buffer
PR middle-end/91647 - new FAILs for Warray-bounds-8 and Wstringop-overflow-3.C
PR middle-end/91463 - missing -Warray-bounds accessing past the end of a statically initialized flexible array member
gcc/ChangeLog:
PR middle-end/91679
PR middle-end/91647
PR middle-end/91463
* tree-vrp.c (vrp_prop::check_array_ref): Handle trailing arrays with
initializers.
(vrp_prop::check_mem_ref): Handle declared struct objects.
* tree.c (last_field): New function.
(array_at_struct_end_p): Handle MEM_REF.
(get_initializer_for): New helper.
(component_ref_size): Rename locals. Call get_initializer_for instead
of fold_ctor_reference. Correct handling of flexible array members.
* wide-int.h (generic_wide_int <storage>::sign_mask): Assert invariant.
gcc/testsuite/ChangeLog:
PR middle-end/91679
PR middle-end/91647
PR middle-end/91463
* c-c++-common/Warray-bounds-2.c: Disable VRP. Adjust expected messages.
* gcc.dg/Warray-bounds-48.c: New test.
* gcc.dg/Warray-bounds-49.c: New test.
* gcc.dg/Wstringop-overflow-16.c: Adjust text of expected messages.
* gcc.dg/pr36902.c: Remove xfail.
* gcc.dg/strlenopt-57.c: Add an expected warning.
diff --git a/gcc/testsuite/c-c++-common/Warray-bounds-2.c b/gcc/testsuite/c-c++-common/Warray-bounds-2.c
index ca2d1c98218..7f925c34bae 100644
--- a/gcc/testsuite/c-c++-common/Warray-bounds-2.c
+++ b/gcc/testsuite/c-c++-common/Warray-bounds-2.c
@@ -6,7 +6,7 @@
source of the excessive array bound is in a different function than
the call.
{ dg-do compile }
- { dg-options "-O2 -Warray-bounds -Wno-stringop-overflow" } */
+ { dg-options "-O2 -Warray-bounds -Wno-stringop-overflow -fno-tree-vrp" } */
#if __has_include (<stddef.h>)
# include <stddef.h>
@@ -216,13 +216,13 @@ void call_strncpy_dst_diff_max (const char *s, size_t n)
static void
wrap_strncpy_dstarray_diff_neg (char *d, const char *s, ptrdiff_t i, size_t n)
{
- strncpy (d + i, s, n); /* { dg-bogus "offset -\[0-9\]+ is out of the bounds \\\[0, 90] of object .ar10. with type .(struct )?Array ?\\\[2]." "strncpy" } */
-} /* { dg-warning "array subscript -1 is outside array bounds" "" { target *-*-* } .-1 } */
+ strncpy (d + i, s, n); /* { dg-warning "offset -\[0-9\]+ is out of the bounds \\\[0, 90] of object .ar10. with type .(struct )?Array ?\\\[2]." "strncpy" } */
+}
void call_strncpy_dstarray_diff_neg (const char *s, size_t n)
{
- struct Array ar10[2]; /* { dg-bogus ".ar10. declared here" } */
- sink (&ar10); /* { dg-message "while referencing" "" { target *-*-* } .-1 } */
+ struct Array ar10[2]; /* { dg-message ".ar10. declared here" } */
+ sink (&ar10);
int off = (char*)ar10[1].a17 - (char*)ar10 + 1;
wrap_strncpy_dstarray_diff_neg (ar10[1].a17, s, -off, n);
diff --git a/gcc/testsuite/gcc.dg/Warray-bounds-46.c b/gcc/testsuite/gcc.dg/Warray-bounds-46.c
index 09b577e6363..d94eaa6c41d 100644
--- a/gcc/testsuite/gcc.dg/Warray-bounds-46.c
+++ b/gcc/testsuite/gcc.dg/Warray-bounds-46.c
@@ -67,7 +67,7 @@ void strcpy_global (void)
SA (__builtin_offsetof (struct MA17, ax) == 157);
- T (gma.ax, 0); // { dg-warning "'strcpy' offset 157 is out of the bounds \\\[0, 157] of object 'gma' with type 'struct MA17'" }
+ T (gma.ax, 0); // { dg-warning "'strcpy' offset 157 from the object at 'gma' is out of the bounds of referenced subobject 'ax' with type 'char[]' at offset 157|'strcpy' offset 157 is out of the bounds \\\[0, 157] of object 'gma' with type 'struct MA17'" }
}
@@ -92,7 +92,7 @@ void strcpy_global_array (void)
T (gma2[0].a17, 16);
T (gma2[0].a17, 17); // { dg-warning "'strcpy' offset 157 from the object at 'gma2' is out of the bounds of referenced subobject 'a17' with type 'char\\\[17]' at offset 140" }
- /* GMA2 is external buts because it's an array its definition in another
+ /* GMA2 is external but because it's an array its definition in another
translation unit may not provide an initializer for the flexible array
member. Verify that a warning is issued for access to it. */
T (gma2[0].ax, 1); // { dg-warning "'strcpy' offset \\\[157, 158] from the object at 'gma2' is out of the bounds of referenced subobject 'ax' with type 'char\\\[]' at offset 157" }
diff --git a/gcc/testsuite/gcc.dg/Warray-bounds-48.c b/gcc/testsuite/gcc.dg/Warray-bounds-48.c
new file mode 100644
index 00000000000..d6a327e3689
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/Warray-bounds-48.c
@@ -0,0 +1,363 @@
+/* PR middle-end/91647 - missing -Warray-bounds accessing a zero-length array
+ of a declared object
+ { dg-do "compile" }
+ { dg-options "-O2 -Wall" } */
+
+typedef __INT16_TYPE__ int16_t;
+typedef __INT32_TYPE__ int32_t;
+
+void sink (void*);
+
+/* Exercise a true flexible member. */
+
+struct AX
+{
+ int32_t n;
+ int16_t ax[]; // { dg-message "while referencing 'ax'" "member" }
+};
+
+static void warn_ax_local (struct AX *p)
+{
+ p->ax[0] = 0; // { dg-warning "\\\[-Warray-bounds" }
+ p->ax[1] = 1; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void nowarn_ax_extern (struct AX *p)
+{
+ p->ax[0] = 0; p->ax[99] = 99; p->ax[999] = 999; p->ax[9999] = 9999;
+}
+
+static void warn_ax_local_buf (struct AX *p)
+{
+ p->ax[0] = 4; p->ax[1] = 5;
+
+ p->ax[2] = 6; // { dg-warning "\\\[-Warray-bounds" }
+ p->ax[3] = 7; // { dg-warning "\\\[-Warray-bounds" }
+ p->ax[4] = 8; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void warn_ax_extern_buf (struct AX *p)
+{
+ p->ax[0] = 9; p->ax[1] = 10; p->ax[2] = 11;
+
+ p->ax[3] = 12; // { dg-warning "\\\[-Warray-bounds" }
+ p->ax[4] = 13; // { dg-warning "\\\[-Warray-bounds" }
+ p->ax[5] = 14; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void nowarn_ax_extern_bufx (struct AX *p)
+{
+ p->ax[0] = 0; p->ax[99] = 99; p->ax[999] = 999; p->ax[9999] = 9999;
+}
+
+static void nowarn_ax_ref (struct AX *p)
+{
+ p->ax[0] = 0; p->ax[99] = 99; p->ax[999] = 999; p->ax[9999] = 9999;
+}
+
+void test_ax (struct AX *p, unsigned n)
+{
+ {
+ struct AX sax; // { dg-message "defined here" "struct definition" }
+ warn_ax_local (&sax);
+ sink (&sax);
+ }
+
+ {
+ extern
+ struct AX xsax;
+ nowarn_ax_extern (&xsax);
+ sink (&xsax);
+ }
+
+ {
+ /* Verify out-of-bounds access to the local BUF is diagnosed. */
+ char ax_buf_p2[sizeof (struct AX) + 2 * sizeof (int16_t)];
+ warn_ax_local_buf ((struct AX*) ax_buf_p2);
+ sink (ax_buf_p2);
+ }
+
+ {
+ /* Verify out-of-bounds access to the extern BUF with a known
+ bound is diagnosed. */
+ extern char ax_buf_p3[sizeof (struct AX) + 3 * sizeof (int16_t)];
+ warn_ax_extern_buf ((struct AX*) ax_buf_p3);
+ sink (ax_buf_p3);
+ }
+
+ {
+ /* Verify that accesses to BUFX with an unknown bound are not
+ diagnosed. */
+ extern char bufx[];
+ nowarn_ax_extern_bufx ((struct AX*) bufx);
+ sink (bufx);
+ }
+
+ {
+ /* Verify that accesses to BUFN with a runtime bound are not
+ diagnosed. */
+ char bufn[n];
+ nowarn_ax_extern_bufx ((struct AX*) bufn);
+ sink (bufn);
+ }
+
+ nowarn_ax_ref (p);
+}
+
+
+/* Exercise a zero-length trailing member array. It's the same as above
+ except that extern declarations with no definitions are considered to
+ have zero elements (they can't be initialized to have any). */
+
+struct A0
+{
+ int32_t n;
+ int16_t a0[0]; // { dg-message "while referencing 'a0'" "member" }
+};
+
+static void warn_a0_local (struct A0 *p)
+{
+ p->a0[0] = 0; // { dg-warning "\\\[-Warray-bounds" }
+ p->a0[1] = 1; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void warn_a0_extern (struct A0 *p)
+{
+ p->a0[0] = 2; // { dg-warning "\\\[-Warray-bounds" }
+ p->a0[1] = 3; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void warn_a0_local_buf (struct A0 *p)
+{
+ p->a0[0] = 4; p->a0[1] = 5;
+
+ p->a0[2] = 6; // { dg-warning "\\\[-Warray-bounds" }
+ p->a0[3] = 7; // { dg-warning "\\\[-Warray-bounds" }
+ p->a0[4] = 8; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void warn_a0_extern_buf (struct A0 *p)
+{
+ p->a0[0] = 9; p->a0[1] = 10; p->a0[2] = 11;
+
+ p->a0[3] = 12; // { dg-warning "\\\[-Warray-bounds" }
+ p->a0[4] = 13; // { dg-warning "\\\[-Warray-bounds" }
+ p->a0[5] = 14; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void nowarn_a0_extern_bufx (struct A0 *p)
+{
+ p->a0[0] = 0; p->a0[99] = 99; p->a0[999] = 999; p->a0[9999] = 9999;
+}
+
+static void nowarn_a0_ref (struct A0 *p)
+{
+ p->a0[0] = 0; p->a0[99] = 99; p->a0[999] = 999; p->a0[9999] = 9999;
+}
+
+void test_a0 (struct A0 *p, unsigned n)
+{
+ {
+ struct A0 sa0; // { dg-message "defined here" "struct definition" }
+ warn_a0_local (&sa0);
+ sink (&sa0);
+ }
+
+ {
+ extern
+ struct A0 xsa0; // { dg-message "defined here" "struct definition" }
+ warn_a0_extern (&xsa0);
+ sink (&xsa0);
+ }
+
+ {
+ /* Verify out-of-bounds access to the local BUF is diagnosed. */
+ char a0_buf_p2[sizeof (struct A0) + 2 * sizeof (int16_t)];
+ warn_a0_local_buf ((struct A0*) a0_buf_p2);
+ sink (a0_buf_p2);
+ }
+
+ {
+ /* Verify out-of-bounds access to the extern BUF with a known
+ bound is diagnosed. */
+ extern char a0_buf_p3[sizeof (struct A0) + 3 * sizeof (int16_t)];
+ warn_a0_extern_buf ((struct A0*) a0_buf_p3);
+ sink (a0_buf_p3);
+ }
+
+ {
+ /* Verify that accesses to BUFX with an unknown bound are not
+ diagnosed. */
+ extern char bufx[];
+ nowarn_a0_extern_bufx ((struct A0*) bufx);
+ sink (bufx);
+ }
+
+ {
+ /* Verify that accesses to BUFN with a runtime bound are not
+ diagnosed. */
+ char bufn[n];
+ nowarn_a0_extern_bufx ((struct A0*) bufn);
+ sink (bufn);
+ }
+
+ nowarn_a0_ref (p);
+}
+
+
+/* Exercise a one-element trailing member array. It's the same as above
+ except that it has exactly one element. */
+
+struct A1
+{
+ int32_t n;
+ int16_t a1[1]; // { dg-message "while referencing 'a1'" }
+};
+
+static void warn_a1_local_noinit (struct A1 *p)
+{
+ p->a1[0] = 0;
+ p->a1[1] = 1; // { dg-warning "\\\[-Warray-bounds" }
+ p->a1[2] = 2; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void warn_a1_extern (struct A1 *p)
+{
+ p->a1[0] = 0;
+ p->a1[1] = 1; // { dg-warning "\\\[-Warray-bounds" }
+ p->a1[2] = 2; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void warn_a1_init (struct A1 *p)
+{
+ p->a1[0] = 0;
+ p->a1[1] = 1; // { dg-warning "\\\[-Warray-bounds" }
+ p->a1[2] = 2; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void warn_a1_local_buf (struct A1 *p)
+{
+ p->a1[0] = 0; p->a1[1] = 1; p->a1[2] = 2; p->a1[3] = 3;
+
+ p->a1[4] = 4; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void warn_a1_extern_buf (struct A1 *p)
+{
+ p->a1[0] = 0; p->a1[1] = 1; p->a1[2] = 2; p->a1[3] = 3; p->a1[4] = 4;
+
+ p->a1[5] = 5; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void nowarn_a1_extern_bufx (struct A1 *p)
+{
+ p->a1[0] = 0; p->a1[99] = 99; p->a1[999] = 999; p->a1[9999] = 9999;
+}
+
+static void nowarn_a1_ref (struct A1 *p)
+{
+ p->a1[0] = 0; p->a1[99] = 99; p->a1[999] = 999; p->a1[9999] = 9999;
+}
+
+void test_a1 (struct A1 *p, unsigned n)
+{
+ {
+ struct A1 a1;
+ warn_a1_local_noinit (&a1);
+ sink (&a1);
+ }
+
+ {
+ extern struct A1 a1x;
+ warn_a1_extern (&a1x);
+ sink (&a1x);
+}
+ {
+ struct A1 a1 = { 0, { 1 } };
+ warn_a1_init (&a1);
+ sink (&a1);
+ }
+
+ {
+ /* Verify out-of-bounds access to the local BUF is diagnosed. */
+ char buf_p2[sizeof (struct A1) + 2 * sizeof (int16_t)];
+ warn_a1_local_buf ((struct A1*) buf_p2);
+ sink (buf_p2);
+ }
+
+ {
+ /* Verify out-of-bounds access to the extern BUF with a known
+ bound is diagnosed. */
+ extern char a1_buf_p3[sizeof (struct A1) + 3 * sizeof (int16_t)];
+ warn_a1_extern_buf ((struct A1*) a1_buf_p3);
+ sink (a1_buf_p3);
+ }
+
+ {
+ /* Verify that accesses to BUFX with an unknown bound are not
+ diagnosed. */
+ extern char bufx[];
+ nowarn_a1_extern_bufx ((struct A1*) bufx);
+ sink (bufx);
+ }
+
+ {
+ /* Verify that accesses to BUFN with a runtime bound are not
+ diagnosed. */
+ char bufn[n];
+ nowarn_a1_extern_bufx ((struct A1*) bufn);
+ sink (bufn);
+ }
+
+ nowarn_a1_ref (p);
+}
+
+
+/* Exercise a two-element trailing member array. It's treated
+ the same as an interior array member. */
+
+struct A2
+{
+ int32_t n;
+ int16_t a2[2]; // { dg-message "while referencing 'a2'" }
+};
+
+static void warn_a2_noinit (struct A2 *p)
+{
+ p->a2[0] = 0; p->a2[1] = 1;
+
+ p->a2[2] = 2; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void warn_a2_init (struct A2 *p)
+{
+ p->a2[0] = 0; p->a2[1] = 1;
+
+ p->a2[2] = 2; // { dg-warning "\\\[-Warray-bounds" }
+ p->a2[9] = 9; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+static void warn_a2_ref (struct A2 *p)
+{
+ p->a2[0] = 0; p->a2[1] = 1;
+
+ p->a2[2] = 2; // { dg-warning "\\\[-Warray-bounds" }
+ p->a2[9] = 9; // { dg-warning "\\\[-Warray-bounds" }
+}
+
+void test_a2 (struct A2 *p)
+{
+ {
+ struct A2 a2;
+ warn_a2_noinit (&a2);
+ sink (&a2);
+ }
+
+ {
+ struct A2 a2 = { 0, { 1, 2 } };
+ warn_a2_init (&a2);
+ sink (&a2);
+ }
+
+ warn_a2_ref (p);
+}
diff --git a/gcc/testsuite/gcc.dg/Warray-bounds-49.c b/gcc/testsuite/gcc.dg/Warray-bounds-49.c
new file mode 100644
index 00000000000..f271dd526b8
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/Warray-bounds-49.c
@@ -0,0 +1,115 @@
+/* PR middle-end/91647 - missing -Warray-bounds accessing a zero-length array
+ of a declared object
+ { dg-do "compile" }
+ { dg-options "-O2 -Wall" } */
+
+struct __attribute__ ((aligned (16))) A16
+{
+ __INT64_TYPE__ i8;
+ __INT16_TYPE__ i2;
+ __INT16_TYPE__ a2[];
+};
+
+struct A16 a0 = { };
+
+void test_a0 (void)
+{
+ // The first three elements fit in the tail padding.
+ a0.a2[0] = 0; a0.a2[1] = 1; a0.a2[2] = 2;
+
+ a0.a2[3] = 3; // { dg-warning "array subscript 3 is above array bounds of 'short int\\\[]'" }
+}
+
+
+struct A16 a1 = { .a2 = { 1 } };
+
+void test_a1 (void)
+{
+ a1.a2[0] = 0; a1.a2[1] = 1; a1.a2[2] = 2;
+
+ a1.a2[3] = 3; // { dg-warning "array subscript 3 is above array bounds of 'short int\\\[]'" }
+}
+
+
+struct A16 a2 = { .a2 = { 1, 2 } };
+
+void test_a2 (void)
+{
+ a2.a2[0] = 0; a2.a2[1] = 1; a2.a2[2] = 2;
+
+ a2.a2[3] = 3; // { dg-warning "array subscript 3 is above array bounds of 'short int\\\[]'" }
+}
+
+
+struct A16 a3 = { .a2 = { 1, 2, 3 } };
+
+void test_a3 (void)
+{
+ a3.a2[0] = 0; a3.a2[1] = 1; a3.a2[2] = 2;
+
+ a3.a2[3] = 3; // { dg-warning "array subscript 3 is above array bounds of 'short int\\\[]'" }
+}
+
+
+struct A16 a4 = { .a2 = { 1, 2, 3, 4 } };
+
+void test_a4 (void)
+{
+ a4.a2[0] = 0; a4.a2[1] = 1; a4.a2[2] = 2; a4.a2[3] = 3;
+
+ a4.a2[4] = 4; // { dg-warning "array subscript 4 is above array bounds of 'short int\\\[]'" }
+}
+
+
+struct A16 a5 = { .a2 = { 1, 2, 3, 4, 5 } };
+
+void test_a5 (void)
+{
+ a5.a2[0] = 0; a5.a2[1] = 1; a5.a2[2] = 2; a5.a2[3] = 3; a5.a2[4] = 4;
+
+ a5.a2[5] = 5; // { dg-warning "array subscript 5 is above array bounds of 'short int\\\[]'" }
+}
+
+
+struct A16 a6 = { .a2 = { 1, 2, 3, 4, 5, 6 } };
+
+void test_a6 (void)
+{
+ a6.a2[0] = 0; a6.a2[1] = 1; a6.a2[2] = 2; a6.a2[3] = 3; a6.a2[4] = 4;
+ a6.a2[5] = 5;
+
+ a6.a2[6] = 6; // { dg-warning "array subscript 6 is above array bounds of 'short int\\\[]'" }
+}
+
+
+struct A16 a7 = { .a2 = { 1, 2, 3, 4, 5, 6, 7 } };
+
+void test_a7 (void)
+{
+ a7.a2[0] = 0; a7.a2[1] = 1; a7.a2[2] = 2; a7.a2[3] = 3; a7.a2[4] = 4;
+ a7.a2[5] = 5; a7.a2[5] = 5; a7.a2[6] = 6;
+
+ a7.a2[7] = 7; // { dg-warning "array subscript 7 is above array bounds of 'short int\\\[]'" }
+}
+
+
+struct A16 a8 = { .a2 = { 1, 2, 3, 4, 5, 6, 7, 8 } };
+
+void test_a8 (void)
+{
+ a8.a2[0] = 0; a8.a2[1] = 1; a8.a2[2] = 2; a8.a2[3] = 3; a8.a2[4] = 4;
+ a8.a2[5] = 5; a8.a2[5] = 5; a8.a2[6] = 6; a8.a2[7] = 7;
+
+ a8.a2[8] = 8; // { dg-warning "array subscript 8 is above array bounds of 'short int\\\[]'" }
+}
+
+
+struct A16 a9 = { .a2 = { 1, 2, 3, 4, 5, 6, 7, 8, 9 } };
+
+void test_a9 (void)
+{
+ a8.a2[0] = 8; a8.a2[1] = 7; a8.a2[2] = 6; a8.a2[3] = 5; a8.a2[4] = 4;
+ a8.a2[5] = 3; a8.a2[5] = 2; a8.a2[6] = 1; a8.a2[7] = 0;
+
+ a8.a2[9] = 8; // { dg-warning "array subscript 9 is above array bounds of 'short int\\\[]'" }
+}
diff --git a/gcc/testsuite/gcc.dg/Wstringop-overflow-16.c b/gcc/testsuite/gcc.dg/Wstringop-overflow-16.c
index 74548a4f0fa..11fb05e730a 100644
--- a/gcc/testsuite/gcc.dg/Wstringop-overflow-16.c
+++ b/gcc/testsuite/gcc.dg/Wstringop-overflow-16.c
@@ -3,7 +3,7 @@
{ dg-options "-O2 -Wall" } */
struct charseq {
- unsigned char bytes[0]; // { dg-message "object declared here" }
+ unsigned char bytes[0]; // { dg-message "while referencing|object declared here" }
};
struct locale_ctype_t {
@@ -15,7 +15,7 @@ void ctype_finish (struct locale_ctype_t *ctype)
long unsigned int cnt;
for (cnt = 0; cnt < 20; ++cnt) {
static struct charseq replace[2];
- replace[0].bytes[1] = '\0'; // { dg-warning "\\\[-Wstringop-overflow" }
+ replace[0].bytes[1] = '\0'; // { dg-warning "\\\[-Warray-bounds|-Wstringop-overflow" }
ctype->mboutdigits[cnt] = &replace[0];
}
}
diff --git a/gcc/testsuite/gcc.dg/pr36902.c b/gcc/testsuite/gcc.dg/pr36902.c
index a065124ae71..cc8650ccb3b 100644
--- a/gcc/testsuite/gcc.dg/pr36902.c
+++ b/gcc/testsuite/gcc.dg/pr36902.c
@@ -44,7 +44,7 @@ foo2(unsigned char * to, const unsigned char * from, int n)
*to = *from;
break;
case 5:
- to[4] = from [4]; /* { dg-warning "array subscript is above array bounds" "" { xfail *-*-* } } */
+ to[4] = from [4]; /* { dg-warning "\\\[-Warray-bounds } */
break;
}
return to;
diff --git a/gcc/testsuite/gcc.dg/strlenopt-57.c b/gcc/testsuite/gcc.dg/strlenopt-57.c
index 49dc8cd6fbb..b7212bcf795 100644
--- a/gcc/testsuite/gcc.dg/strlenopt-57.c
+++ b/gcc/testsuite/gcc.dg/strlenopt-57.c
@@ -21,7 +21,7 @@ void test_var_flexarray_cst_off (void)
{
/* Use arbitrary constants greater than 16 in case GCC ever starts
unrolling strlen() calls with small array arguments. */
- a[0] = 17 < strlen (a0.a + 1);
+ a[0] = 17 < strlen (a0.a + 1); // { dg-warning "\\\[-Warray-bounds" }
a[1] = 19 < strlen (a1.a + 1);
a[2] = 23 < strlen (a9.a + 9);
a[3] = 29 < strlen (ax.a + 3);
diff --git a/gcc/tree-vrp.c b/gcc/tree-vrp.c
index d69cfb107cb..0b8d8915bd1 100644
--- a/gcc/tree-vrp.c
+++ b/gcc/tree-vrp.c
@@ -4133,11 +4133,22 @@ vrp_prop::check_array_ref (location_t location, tree ref,
}
else
{
- tree maxbound = TYPE_MAX_VALUE (ptrdiff_type_node);
+ tree ptrdiff_max = TYPE_MAX_VALUE (ptrdiff_type_node);
+ tree maxbound = ptrdiff_max;
tree arg = TREE_OPERAND (ref, 0);
poly_int64 off;
- if (get_addr_base_and_unit_offset (arg, &off) && known_gt (off, 0))
+ if (TREE_CODE (arg) == COMPONENT_REF)
+ {
+ /* Try to determine the size of the trailing array from
+ its initializer (if it has one). */
+ if (tree refsize = component_ref_size (arg))
+ maxbound = refsize;
+ }
+
+ if (maxbound == ptrdiff_max
+ && get_addr_base_and_unit_offset (arg, &off)
+ && known_gt (off, 0))
maxbound = wide_int_to_tree (sizetype,
wi::sub (wi::to_wide (maxbound),
off));
@@ -4223,11 +4234,23 @@ vrp_prop::check_array_ref (location_t location, tree ref,
if (warned)
{
ref = TREE_OPERAND (ref, 0);
+
+ tree rec = NULL_TREE;
if (TREE_CODE (ref) == COMPONENT_REF)
- ref = TREE_OPERAND (ref, 1);
+ {
+ /* For a reference to a member of a struct object also mention
+ the object if it's known. It may be defined in a different
+ function than the out-of-bounds access. */
+ rec = TREE_OPERAND (ref, 0);
+ if (!VAR_P (rec))
+ rec = NULL_TREE;
+ ref = TREE_OPERAND (ref, 1);
+ }
if (DECL_P (ref))
inform (DECL_SOURCE_LOCATION (ref), "while referencing %qD", ref);
+ if (rec && DECL_P (rec))
+ inform (DECL_SOURCE_LOCATION (rec), "defined here %qD", rec);
TREE_NO_WARNING (ref) = 1;
}
@@ -4372,16 +4395,21 @@ vrp_prop::check_mem_ref (location_t location, tree ref,
/* The type of the object being referred to. It can be an array,
string literal, or a non-array type when the MEM_REF represents
a reference/subscript via a pointer to an object that is not
- an element of an array. References to members of structs and
- unions are excluded because MEM_REF doesn't make it possible
- to identify the member where the reference originated.
- Incomplete types are excluded as well because their size is
- not known. */
+ an element of an array. Incomplete types are excluded as well
+ because their size is not known. */
tree reftype = TREE_TYPE (arg);
if (POINTER_TYPE_P (reftype)
|| !COMPLETE_TYPE_P (reftype)
- || TREE_CODE (TYPE_SIZE_UNIT (reftype)) != INTEGER_CST
- || RECORD_OR_UNION_TYPE_P (reftype))
+ || TREE_CODE (TYPE_SIZE_UNIT (reftype)) != INTEGER_CST)
+ return false;
+
+ /* Except in declared objects, references to trailing array members
+ of structs and union objects are excluded because MEM_REF doesn't
+ make it possible to identify the member where the reference
+ originated. */
+ if (RECORD_OR_UNION_TYPE_P (reftype)
+ && (!VAR_P (arg)
+ || (DECL_EXTERNAL (arg) && array_at_struct_end_p (ref))))
return false;
arrbounds[0] = 0;
@@ -4393,7 +4421,14 @@ vrp_prop::check_mem_ref (location_t location, tree ref,
if (tree dom = TYPE_DOMAIN (reftype))
{
tree bnds[] = { TYPE_MIN_VALUE (dom), TYPE_MAX_VALUE (dom) };
- if (array_at_struct_end_p (arg) || !bnds[0] || !bnds[1])
+ if (TREE_CODE (arg) == COMPONENT_REF)
+ {
+ offset_int size = maxobjsize;
+ if (tree fldsize = component_ref_size (arg))
+ size = wi::to_offset (fldsize);
+ arrbounds[1] = wi::lrshift (size, wi::floor_log2 (eltsize));
+ }
+ else if (array_at_struct_end_p (arg) || !bnds[0] || !bnds[1])
arrbounds[1] = wi::lrshift (maxobjsize, wi::floor_log2 (eltsize));
else
arrbounds[1] = (wi::to_offset (bnds[1]) - wi::to_offset (bnds[0])
@@ -4415,7 +4450,13 @@ vrp_prop::check_mem_ref (location_t location, tree ref,
else
{
eltsize = 1;
- arrbounds[1] = wi::to_offset (TYPE_SIZE_UNIT (reftype));
+ tree size = TYPE_SIZE_UNIT (reftype);
+ if (VAR_P (arg))
+ if (tree initsize = DECL_SIZE_UNIT (arg))
+ if (tree_int_cst_lt (size, initsize))
+ size = initsize;
+
+ arrbounds[1] = wi::to_offset (size);
}
offrange[0] += ioff;
diff --git a/gcc/tree.c b/gcc/tree.c
index e845fc7a00e..355219dd8f5 100644
--- a/gcc/tree.c
+++ b/gcc/tree.c
@@ -3088,6 +3088,25 @@ first_field (const_tree type)
return t;
}
+/* Returns the last FIELD_DECL in the TYPE_FIELDS of the RECORD_TYPE or
+ UNION_TYPE TYPE, or NULL_TREE if none. */
+
+tree
+last_field (const_tree type)
+{
+ tree last = NULL_TREE;
+
+ for (tree fld = TYPE_FIELDS (type); fld; fld = TREE_CHAIN (fld))
+ {
+ if (TREE_CODE (fld) != FIELD_DECL)
+ continue;
+
+ last = fld;
+ }
+
+ return last;
+}
+
/* Concatenate two chains of nodes (chained through TREE_CHAIN)
by modifying the last node in chain 1 to point to chain 2.
This is the Lisp primitive `nconc'. */
@@ -13717,8 +13736,8 @@ array_ref_up_bound (tree exp)
return NULL_TREE;
}
-/* Returns true if REF is an array reference or a component reference
- to an array at the end of a structure.
+/* Returns true if REF is an array reference, component reference,
+ or memory reference to an array at the end of a structure.
If this is the case, the array may be allocated larger
than its upper bound implies. */
@@ -13736,6 +13755,28 @@ array_at_struct_end_p (tree ref)
else if (TREE_CODE (ref) == COMPONENT_REF
&& TREE_CODE (TREE_TYPE (TREE_OPERAND (ref, 1))) == ARRAY_TYPE)
atype = TREE_TYPE (TREE_OPERAND (ref, 1));
+ else if (TREE_CODE (ref) == MEM_REF)
+ {
+ tree arg = TREE_OPERAND (ref, 0);
+ if (TREE_CODE (arg) == ADDR_EXPR)
+ arg = TREE_OPERAND (arg, 0);
+ tree argtype = TREE_TYPE (arg);
+ if (TREE_CODE (argtype) == RECORD_TYPE)
+ {
+ if (tree fld = last_field (argtype))
+ {
+ atype = TREE_TYPE (fld);
+ if (TREE_CODE (atype) != ARRAY_TYPE)
+ return false;
+ if (VAR_P (arg) && DECL_SIZE (fld))
+ return false;
+ }
+ else
+ return false;
+ }
+ else
+ return false;
+ }
else
return false;
@@ -13852,6 +13893,33 @@ component_ref_field_offset (tree exp)
return SUBSTITUTE_PLACEHOLDER_IN_EXPR (DECL_FIELD_OFFSET (field), exp);
}
+/* Given the initializer INIT, return the initializer for the field
+ DECL if it exists, otherwise null. Used to obtain the initializer
+ for a flexible array member and determine its size. */
+
+static tree
+get_initializer_for (tree init, tree decl)
+{
+ STRIP_NOPS (init);
+
+ tree fld, fld_init;
+ unsigned HOST_WIDE_INT i;
+ FOR_EACH_CONSTRUCTOR_ELT (CONSTRUCTOR_ELTS (init), i, fld, fld_init)
+ {
+ if (decl == fld)
+ return fld_init;
+
+ if (TREE_CODE (fld) == CONSTRUCTOR)
+ {
+ fld_init = get_initializer_for (fld_init, decl);
+ if (fld_init)
+ return fld_init;
+ }
+ }
+
+ return NULL_TREE;
+}
+
/* Determines the size of the member referenced by the COMPONENT_REF
REF, using its initializer expression if necessary in order to
determine the size of an initialized flexible array member.
@@ -13866,19 +13934,17 @@ component_ref_size (tree ref)
tree member = TREE_OPERAND (ref, 1);
- /* If the member is not an array, or is not last, or is an array with
- more than one element, return its size. Otherwise it's either
- a bona fide flexible array member, or a zero-length array member,
- or an array of length one treated as such. */
- tree size = DECL_SIZE_UNIT (member);
- if (size)
+ tree memsize = DECL_SIZE_UNIT (member);
+ if (memsize)
{
tree memtype = TREE_TYPE (member);
if (TREE_CODE (memtype) != ARRAY_TYPE
|| !array_at_struct_end_p (ref))
- return size;
+ /* MEMBER is not an array, or is not last, or is an array with
+ more than one element. */
+ return memsize;
- if (!integer_zerop (size))
+ if (!integer_zerop (memsize))
if (tree dom = TYPE_DOMAIN (memtype))
if (tree min = TYPE_MIN_VALUE (dom))
if (tree max = TYPE_MAX_VALUE (dom))
@@ -13887,37 +13953,104 @@ component_ref_size (tree ref)
{
offset_int minidx = wi::to_offset (min);
offset_int maxidx = wi::to_offset (max);
- if (maxidx - minidx > 1)
- return size;
+ if (maxidx - minidx > 0)
+ /* MEMBER is an array with more than 1 element. */
+ return memsize;
}
}
+ /* MEMBER is either a bona fide flexible array member, or a zero-length
+ array member, or an array of length one treated as such. */
+
/* If the reference is to a declared object and the member a true
flexible array, try to determine its size from its initializer. */
- poly_int64 off = 0;
- tree base = get_addr_base_and_unit_offset (ref, &off);
+ poly_int64 baseoff = 0;
+ tree base = get_addr_base_and_unit_offset (ref, &baseoff);
if (!base || !VAR_P (base))
return NULL_TREE;
- /* The size of any member of a declared object other than a flexible
- array member is that obtained above. */
- if (size)
- return size;
-
+ /* BASE is the declared object of which MEMBER is either a member
+ or that is is cast to REFTYPE (e.g., a char buffer used to store
+ a REFTYPE object). */
+ tree reftype = TREE_TYPE (TREE_OPERAND (ref, 0));
+ tree basetype = TREE_TYPE (base);
+
+ /* Determine the base type of the referenced object. If it's
+ the same as REFTYPE and MEMBER has a known size return it. */
+ tree bt = basetype;
+ while (TREE_CODE (bt) == ARRAY_TYPE)
+ bt = TREE_TYPE (bt);
+ bool typematch = useless_type_conversion_p (reftype, bt);
+ if (memsize && typematch)
+ return memsize;
+
+ memsize = NULL_TREE;
+
+ /* MEMBER is a true flexible array member. Compute its size from
+ the initializer of the BASE object if it has one. */
if (tree init = DECL_INITIAL (base))
- if (TREE_CODE (init) == CONSTRUCTOR)
- {
- off <<= LOG2_BITS_PER_UNIT;
- init = fold_ctor_reference (NULL_TREE, init, off, 0, base);
- if (init)
- return TYPE_SIZE_UNIT (TREE_TYPE (init));
- }
+ {
+ init = get_initializer_for (init, member);
+ if (init)
+ {
+ memsize = TYPE_SIZE_UNIT (TREE_TYPE (init));
+ if (tree refsize = TYPE_SIZE_UNIT (reftype))
+ {
+ /* Use the larger of the initializer size and the tail
+ padding in the enclosing struct. */
+ poly_int64 rsz = tree_to_poly_int64 (refsize);
+ rsz -= baseoff;
+ if (known_lt (tree_to_poly_int64 (memsize), rsz))
+ memsize = wide_int_to_tree (TREE_TYPE (memsize), rsz);
+ }
+
+ baseoff = 0;
+ }
+ }
+
+ if (!memsize)
+ {
+ if (typematch)
+ {
+ if (DECL_EXTERNAL (base) && bt == basetype)
+ /* The size of a flexible array member of an extern struct
+ with no initializer cannot be determined (it's defined
+ in another translation unit and can have an initializer
+ witth an arbitrary number of elements). */
+ return NULL_TREE;
+ /* Use the size of the struct. */
+ memsize = TYPE_SIZE_UNIT (bt);
+ }
+ else
+ /* Use the size of the BASE object (possibly an array of some
+ other type such as char used to store the struct). */
+ memsize = DECL_SIZE_UNIT (base);
+ }
+
+ /* If the flexible array member has a known size use the greater
+ of it and the tail padding in the enclosing struct.
+ Otherwise, when the size of the flexible array member is unknown
+ and the referenced object is not a struct, use the size of its
+ type when known. This detects sizes of array buffers when cast
+ to struct types with flexible array members. */
+ if (memsize)
+ {
+ poly_int64 memsz64 = memsize ? tree_to_poly_int64 (memsize) : 0;
+ if (known_lt (baseoff, memsz64))
+ {
+ memsz64 -= baseoff;
+ return wide_int_to_tree (TREE_TYPE (memsize), memsz64);
+ }
+ return integer_zero_node;
+ }
/* Return "don't know" for an external non-array object since its
flexible array member can be initialized to have any number of
elements. Otherwise, return zero because the flexible array
member has no elements. */
- return (DECL_EXTERNAL (base) && TREE_CODE (TREE_TYPE (base)) != ARRAY_TYPE
+ return (DECL_EXTERNAL (base)
+ && (!typematch
+ || TREE_CODE (basetype) != ARRAY_TYPE)
? NULL_TREE : integer_zero_node);
}
diff --git a/gcc/wide-int.h b/gcc/wide-int.h
index 862079a8549..5e0f444f9a6 100644
--- a/gcc/wide-int.h
+++ b/gcc/wide-int.h
@@ -852,6 +852,8 @@ inline HOST_WIDE_INT
generic_wide_int <storage>::sign_mask () const
{
unsigned int len = this->get_len ();
+ gcc_assert (len > 0);
+
unsigned HOST_WIDE_INT high = this->get_val ()[len - 1];
if (!is_sign_extended)
{
