-Warray-bounds issue

[Matt Hargett]

Hi,

I'll be teaching a class this week on code analysis and I wanted to 
demonstrate GCC 4.3's new array bounds analysis capabilities.
Unfortunately, I can't seem to get the new array bounds warnings to appear in 
gcc-4.3-20070720 using the commandline of '-O2 -Warray-bounds' with either of 
the following code:

#include 

int main(int argc, char **argv)
{
size_t size = 16;
char p[size];
p[16] = 0;
}


--

#include 

int main(int argc, char **argv)
{
char p[16];
p[16] = 0;
}

--

I have tried making the overflow more pronounced, using -O3, and various other 
things. I bootstrapped from the sources, but there didn't appear to be any 
special configure switch I was supposed to apply. I did a profiledbootstrap.

If someone could help me figure out what I'm doing wrong, or if I should use 
an older snapshot, that would be great. I am really excited about the 
increased quality this has the capability to bring to all open source 
applications!

Thanks in advance for any help!

Re: -Warray-bounds issue

[Matt Hargett]

Diego,

Thanks so much for the quick reponse! Some more questions below :)

On Monday 23 July 07 11:54:58 Diego Novillo wrote:
> On 7/23/07 2:44 PM, Matt Hargett wrote:
> > #include 
> >
> > int main(int argc, char **argv)
> > {
> > size_t size = 16;
> > char p[size];
> > p[16] = 0;
> > }
> >
> >
> > --
> >
> > #include 
> >
> > int main(int argc, char **argv)
> > {
> > char p[16];
> > p[16] = 0;
> > }
> >
> > --
>
> In the first case, it fails because the warning does not really work
> with alloca'd objects (dynamic arrays).  It could probably be made to
> understand them, but it doesn't right now.  It only works on static arrays.

Okay, thanks for the clarification! Is this something that will be addressed 
before GCC 4.3 is released? Interestingly, PC-Lint can only track the size of 
the dynamic array if the const qualifier is used on the size parameter. 


> The second case probably fails because all that code is dead and removed
> before the warning machinery has a chance to examine the code.  Try
> adding something like 'return p[3];' before the end of the function.

That did it, thanks!

My next quest is to get the warning on a heap-based buffer allocated via 
malloc:

#include 

int main(int argc, char **argv)
{
const size_t size = 16;
char *p = malloc(size);
p[size] = 0;

printf(p);
}

--

I assume I have to include a declaration of malloc that has been annotated 
properly? I tried adding this line below the #include:
void* malloc(size_t) __attribute__((alloc_size(1)));

But it has no effect. I tried adding that line above the #include and got a 
segfault:
simple-malloc-via-stack-oob.c:1: warning: parameter names (without types) in 
function declaration
simple-malloc-via-stack-oob.c:1: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.


How can I get an array-bounds warning with malloc()?

Thanks for the help, I really appreciate it!