I noticed that region_model's fill_region/zero_fill_region member
functions weren't checking that the write to the region was valid.
Fixed thusly.
Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu.
Pushed to trunk as r14-3739-gb923978a6ec447.
gcc/analyzer/ChangeLog:
* kf.cc (kf_calloc::impl_call_pre): Pass ctxt to zero_fill_region.
(kf_memset::impl_call_pre): Move responsibility for calling
check_region_for_write to fill_region.
* region-model.cc (region_model::on_assignment): Pass ctxt to
zero_fill_region.
(region_model::fill_region): Add "ctxt" param, using it to call
check_region_for_write.
(region_model::zero_fill_region): Likewise.
* region-model.h (region_model::fill_region): Add "ctxt" param.
(region_model::zero_fill_region): Likewise.
gcc/testsuite/ChangeLog:
* gcc.dg/plugin/analyzer_cpython_plugin.c: Pass ctxt to
zero_fill_region.
---
gcc/analyzer/kf.cc | 7 ++-----
gcc/analyzer/region-model.cc | 19 ++++++++++++++-----
gcc/analyzer/region-model.h | 7 +++++--
.../gcc.dg/plugin/analyzer_cpython_plugin.c | 2 +-
4 files changed, 22 insertions(+), 13 deletions(-)
diff --git a/gcc/analyzer/kf.cc b/gcc/analyzer/kf.cc
index e5bd7459f271..a62227729991 100644
--- a/gcc/analyzer/kf.cc
+++ b/gcc/analyzer/kf.cc
@@ -358,7 +358,7 @@ kf_calloc::impl_call_pre (const call_details &cd) const
= model->get_or_create_region_for_heap_alloc (prod_sval, cd.get_ctxt ());
const region *sized_reg
= mgr->get_sized_region (new_reg, NULL_TREE, prod_sval);
- model->zero_fill_region (sized_reg);
+ model->zero_fill_region (sized_reg, cd.get_ctxt ());
if (cd.get_lhs_type ())
{
const svalue *ptr_sval
@@ -650,10 +650,7 @@ kf_memset::impl_call_pre (const call_details &cd) const
const region *sized_dest_reg = mgr->get_sized_region (dest_reg,
NULL_TREE,
num_bytes_sval);
- model->check_region_for_write (sized_dest_reg,
- nullptr,
- cd.get_ctxt ());
- model->fill_region (sized_dest_reg, fill_value_u8);
+ model->fill_region (sized_dest_reg, fill_value_u8, cd.get_ctxt ());
cd.maybe_set_lhs (dest_sval);
}
diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc
index 82bc3b2c3826..6be0ad72aaae 100644
--- a/gcc/analyzer/region-model.cc
+++ b/gcc/analyzer/region-model.cc
@@ -1204,7 +1204,7 @@ region_model::on_assignment (const gassign *assign,
region_model_context *ctxt)
/* Any CONSTRUCTOR that survives to this point is either
just a zero-init of everything, or a vector. */
if (!CONSTRUCTOR_NO_CLEARING (rhs1))
- zero_fill_region (lhs_reg);
+ zero_fill_region (lhs_reg, ctxt);
unsigned ix;
tree index;
tree val;
@@ -3929,19 +3929,28 @@ region_model::purge_region (const region *reg)
m_store.purge_region (m_mgr->get_store_manager(), reg);
}
-/* Fill REG with SVAL. */
+/* Fill REG with SVAL.
+ Use CTXT to report any warnings associated with the write
+ (e.g. out-of-bounds). */
void
-region_model::fill_region (const region *reg, const svalue *sval)
+region_model::fill_region (const region *reg,
+ const svalue *sval,
+ region_model_context *ctxt)
{
+ check_region_for_write (reg, nullptr, ctxt);
m_store.fill_region (m_mgr->get_store_manager(), reg, sval);
}
-/* Zero-fill REG. */
+/* Zero-fill REG.
+ Use CTXT to report any warnings associated with the write
+ (e.g. out-of-bounds). */
void
-region_model::zero_fill_region (const region *reg)
+region_model::zero_fill_region (const region *reg,
+ region_model_context *ctxt)
{
+ check_region_for_write (reg, nullptr, ctxt);
m_store.zero_fill_region (m_mgr->get_store_manager(), reg);
}
diff --git a/gcc/analyzer/region-model.h b/gcc/analyzer/region-model.h
index bb50ff12b12e..625f68805361 100644
--- a/gcc/analyzer/region-model.h
+++ b/gcc/analyzer/region-model.h
@@ -370,8 +370,11 @@ class region_model
void set_value (tree lhs, tree rhs, region_model_context *ctxt);
void clobber_region (const region *reg);
void purge_region (const region *reg);
- void fill_region (const region *reg, const svalue *sval);
- void zero_fill_region (const region *reg);
+ void fill_region (const region *reg,
+ const svalue *sval,
+ region_model_context *ctxt);
+ void zero_fill_region (const region *reg,
+ region_model_context *ctxt);
void write_bytes (const region *dest_reg,
const svalue *num_bytes_sval,
const svalue *sval,
diff --git a/gcc/testsuite/gcc.dg/plugin/analyzer_cpython_plugin.c
b/gcc/testsuite/gcc.dg/plugin/analyzer_cpython_plugin.c
index bf1982e79c37..a364c8a678b9 100644
--- a/gcc/testsuite/gcc.dg/plugin/analyzer_cpython_plugin.c
+++ b/gcc/testsuite/gcc.dg/plugin/analyzer_cpython_plugin.c
@@ -1031,7 +1031,7 @@ kf_PyList_New::impl_call_post (const call_details &cd)
const
const region *ob_item_sized_region
= model->get_or_create_region_for_heap_alloc (prod_sval,
cd.get_ctxt ());
- model->zero_fill_region (ob_item_sized_region);
+ model->zero_fill_region (ob_item_sized_region, cd.get_ctxt ());
const svalue *ob_item_ptr_sval
= mgr->get_ptr_svalue (pyobj_ptr_ptr, ob_item_sized_region);
const svalue *ob_item_unmergeable
--
2.26.3
