https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105264
--- Comment #6 from David Malcolm ---
There are some fiddly issues where the analyzer fails to figure out that ptr +
i and &ptr[i] refer to the same memory, for certain symbolic values of i.
I'm testing a partial fix for GCC 12, which at least
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105273
--- Comment #4 from David Malcolm ---
Thanks for filing this bug.
IIRC in the initial GCC 10 release of the analyzer, it didn't directly explore
within static functions, and instead only explored them via callsites. I
tweaked the policy for th
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105264
--- Comment #8 from David Malcolm ---
The above patch hopefully fixes the false positive you're seeing, but as noted,
there are some deeper issues that it doesn't fix; keeping this bug open.
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105287
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Last reconfirmed|
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105285
--- Comment #3 from David Malcolm ---
Thanks for filing this bug; I can reproduce it with the initial attachment;
it's unclear to me yet what's going on.
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105365
David Malcolm changed:
What|Removed |Added
Status|NEW |ASSIGNED
--- Comment #2 from David Malc
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105366
David Malcolm changed:
What|Removed |Added
Status|NEW |ASSIGNED
--- Comment #2 from David Malc
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 97110
Target Milestone: ---
-fanalyzer doesn't work well with C++ coroutines.
For example, trying it on
gcc/testsuite/g++.dg/coroutines/torture/co-yield-01-multi.C lea
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105287
--- Comment #5 from David Malcolm ---
Thanks. FWIW I've filed PR 105382 to track the various other issues I'm seeing
with -fanalyzer with coroutines (though given that we don't properly support
C++ yet, that's relatively low priority for me).
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105365
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|ASSIGNED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105366
David Malcolm changed:
What|Removed |Added
Summary|[11/12 Regression] ICE: in |[11 Regression] ICE: in
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104308
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|WAITING
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105382
--- Comment #1 from David Malcolm ---
Looks like the analyzer is assuming that all of the different
_Coro_resume_index values are possible at each entry to f(f()::_Z1fv.Frame*),
but AIUI that value is expressing which basic block the coroutine i
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105285
--- Comment #4 from David Malcolm ---
Created attachment 52892
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52892&action=edit
Partially reduced reproducer
I reduced the reproducer and am attaching it.
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105285
--- Comment #5 from David Malcolm ---
I've been attempting to debug this.
I think that there is a bug in both (a) the analyzer, and, possibly (b) in the
software under test (git).
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105285
--- Comment #6 from David Malcolm ---
For (a):
If I'm reading this right:
reader_init_block_reader has:
struct reftable_block block = {((void *)0)};
reader_init_block_reader checks for (next_off >= r->size) and bails out,
otherwise, block
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105285
--- Comment #7 from David Malcolm ---
For (b), I'm not convinced git's code is totally correct here.
The early-reject case in reader_get_block returns 0:
if (off >= r->size)
return 0;
but at the caller, the condition is < 0:
err = re
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105285
David Malcolm changed:
What|Removed |Added
Last reconfirmed||2022-04-27
Ever confirmed|0
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105287
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105285
--- Comment #11 from David Malcolm ---
Should be fixed on trunk for GCC 13 by the above commit.
I hope to backport this to GCC 12; keeping this open until that's done.
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105366
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 106358
Target Milestone: ---
See: https://godbolt.org/z/P5nGMohxd
Am seeing false positive with -O1 -fanalyzer -fanalyzer-checker=taint
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106373
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Last reconfirmed|
: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 106358
Target Milestone: ---
I'm seeing an ICE in -fanalyzer on the Linux kernel's fs/crypto/hkdf.c in
function hkdf_extract.
Reduced reproducer:
typedef unsign
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106374
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Last reconfirmed|
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106373
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106358
Bug 106358 depends on bug 106373, which changed state.
Bug 106373 Summary: False positives from -Wanalyzer-tainted-array-index on
comparison with non-const
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106373
What|Removed
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106374
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106358
Bug 106358 depends on bug 106374, which changed state.
Bug 106374 Summary: [13 Regression] -fanalyzer ICE with certain const static
vars
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106374
What|Removed |Added
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 106358
Target Milestone: ---
https://godbolt.org/z/c87abh5vc
Given:
typedef __builtin_va_list va_list;
struct printf_spec {
unsigned int type;
};
int
format_decode
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106383
David Malcolm changed:
What|Removed |Added
Last reconfirmed||2022-07-21
Status|UNCONFIRM
: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
CC: tlange at gcc dot gnu.org
Blocks: 106358
Target Milestone: ---
Given:
struct msm_gpu {
// [...snip...]
const
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106383
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106358
Bug 106358 depends on bug 106383, which changed state.
Bug 106383 Summary: False positives from -Wanalyzer-va-list-exhausted
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106383
What|Removed |Added
-
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106394
David Malcolm changed:
What|Removed |Added
Assignee|dmalcolm at gcc dot gnu.org|tlange at gcc dot
gnu.org
: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
I accidentally introduced:
FAIL: gcc.dg/analyzer/stdarg-3.c (test for excess errors)
in r13-1786-gb852aa7f265424; the
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106413
David Malcolm changed:
What|Removed |Added
Status|UNCONFIRMED |ASSIGNED
Ever confirmed|0
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106401
David Malcolm changed:
What|Removed |Added
Status|NEW |RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106413
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106003
--- Comment #6 from David Malcolm ---
I don't think we were tracking the RFE for this in bugzilla, so just a note
that Immad had now committed his patch for the three new attributes for
functions that make use of file descriptors:
https://gcc.gn
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
See: https://gcc.gnu.org/onlinedocs/gcc/Nested-Functions.html
Given:
#include "analyzer-decls.h"
static int __attribute__
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106441
--- Comment #1 from David Malcolm ---
Above example on Compiler Explorer:
https://godbolt.org/z/Pv1GoonE6
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106319
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|UNCONFIRMED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106358
Bug 106358 depends on bug 106319, which changed state.
Bug 106319 Summary: False positives from -Wanalyzer-va-arg-type-mismatch on int
promotion
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106319
What|Removed
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106454
David Malcolm changed:
What|Removed |Added
Status|UNCONFIRMED |NEW
Ever confirmed|0
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106454
--- Comment #2 from David Malcolm ---
...i.e. it's getting confused about liveness. It's considering that the call
to c could have overwritten the old value of d with a new value (or d->args),
and thus that this hypothetical new value of d->arg
at gcc dot gnu.org|mir at gcc dot gnu.org
Ever confirmed|0 |1
Status|UNCONFIRMED |ASSIGNED
--- Comment #2 from David Malcolm ---
Immad's looking at this one.
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106358
Bug 106358 depends on bug 106225, which changed state.
Bug 106225 Summary: False positives from -Wanalyzer-tainted-divisor
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106225
What|Removed |Added
---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106225
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|ASSIGNED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106204
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|ASSIGNED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106358
Bug 106358 depends on bug 106204, which changed state.
Bug 106204 Summary: False positive from -Wanalyzer-use-of-uninitialized-value
with -ftrivial-auto-var-init=zero
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106204
What|Remov
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105285
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99860
--- Comment #2 from David Malcolm ---
Quoting Paul Eggert here:
https://lists.gnu.org/archive/html/bug-gnulib/2022-07/msg00066.html
> I looked into this a bit more, and it turns out that GCC was wrong
> about
> what happens when some paramete
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105893
David Malcolm changed:
What|Removed |Added
Last reconfirmed||2022-07-28
Ever confirmed|0
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106007
--- Comment #1 from David Malcolm ---
Similarly, putenv should check for tainted string args.
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106007
--- Comment #2 from David Malcolm ---
Currently the taint analysis only has handling for numeric arguments being
bounds-checked.
How can string arguments transition to a "sanitized" state? Or are string
arguments always tainted once they've ac
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105893
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|ASSIGNED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105887
Bug 105887 depends on bug 105893, which changed state.
Bug 105893 Summary: RFE: -fanalyzer could check putenv calls
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105893
What|Removed |Added
--
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106147
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Last reconfirmed|
ormal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
realloc's success_with_move::update_model uses the new size of the buffer when
copying the contents of the old buffer,
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105947
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|UNCONFIRMED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105887
Bug 105887 depends on bug 105947, which changed state.
Bug 105947 Summary: RFE: -fanalyzer should complain about jumps through NULL
function pointers
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105947
What|Removed
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106551
David Malcolm changed:
What|Removed |Added
CC||mir at gcc dot gnu.org
--- Comment #1 f
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
CC: mir at gcc dot gnu.org
Target Milestone: ---
Consider:
int dup (int old_fd);
int not_dup (int old_fd);
int
test_1
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106573
David Malcolm changed:
What|Removed |Added
Status|UNCONFIRMED |ASSIGNED
Ever confirmed|0
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106573
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106203
--- Comment #1 from David Malcolm ---
I've been prototyping an implementation of PR 106147 (infinite loop detection),
and in some cases there aren't any statements at all for my warnings, just
location_t values (if that). So as part of that I'v
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106147
--- Comment #3 from David Malcolm ---
See also https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106203#c1 (w.r.t possible
revamp of how source locations are tracked in the analyzer, given that an
infinite loop might not contain any statements)
||dmalcolm at gcc dot gnu.org
Component|c++ |c
Assignee|unassigned at gcc dot gnu.org |dmalcolm at gcc dot
gnu.org
--- Comment #24 from David Malcolm ---
I'm working on an implementation of this.
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90885
--- Comment #25 from David Malcolm ---
Created attachment 53435
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53435&action=edit
v1 of a patch to implement -Wxor-used-as-pow
This patch implements the warning, but doesn't work well; as note
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90885
David Malcolm changed:
What|Removed |Added
Keywords||patch
Status|ASSIGNED
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
Currently -Wanalyzer-out-of-bounds only warns when:
* the size of the memory access is constant, rather than symbolic, and
* the
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106625
David Malcolm changed:
What|Removed |Added
CC||tlange at gcc dot gnu.org
--- Comment #
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
CC: tlange at gcc dot gnu.org
Target Milestone: ---
During the patch review of -Wanalyzer-out-of-bounds we decided to focus on
getting the feature implemented in trunk
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106620
David Malcolm changed:
What|Removed |Added
Status|UNCONFIRMED |RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106620
--- Comment #2 from David Malcolm ---
(In reply to David Malcolm from comment #1)
> I've made lots of implementation changes to -fanalyzer in gcc 12 in beyond
"and beyond", I meant to say
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106634
David Malcolm changed:
What|Removed |Added
See Also||https://gcc.gnu.org/bugzill
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106539
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|UNCONFIRMED
|--- |FIXED
CC||dmalcolm at gcc dot gnu.org
--- Comment #8 from David Malcolm ---
Presumably fixed by the above commit; marking as resolved.
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106003
Bug 106003 depends on bug 106551, which changed state.
Bug 106551 Summary: [13 Regression] dup2 causes -fanalyzer ICE in
valid_to_unchecked_state, at analyzer/sm-fd.cc:751
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106551
What|
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106181
David Malcolm changed:
What|Removed |Added
CC||dmalcolm at gcc dot gnu.org
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106703
David Malcolm changed:
What|Removed |Added
Last reconfirmed||2022-08-21
Ever confirmed|0
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98247
David Malcolm changed:
What|Removed |Added
See Also||https://gcc.gnu.org/bugzill
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98247
--- Comment #3 from David Malcolm ---
Seems to work:
Does not warn for provided example:
https://godbolt.org/z/Wa3E8Mdqr
If I increase the memset to access one beyond, it complains:
https://godbolt.org/z/K6Wcneh8Y
with the caveat th
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87403
Bug 87403 depends on bug 90885, which changed state.
Bug 90885 Summary: GCC should warn about 2^16 and 2^32 and 2^64
[-Wxor-used-as-pow]
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90885
What|Removed |Added
--
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90885
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|WAITING
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106845
--- Comment #2 from David Malcolm ---
Failing assertion here:
#1 0x014df116 in ana::byte_range::exceeds_p (this=0x7fffbf80,
other=..., out_overhanging_byte_range=0x7fffbfc0)
at ../../src/gcc/analyzer/store.cc:464
464
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106845
--- Comment #4 from David Malcolm ---
(In reply to Tim Lange from comment #3)
> It seems to me that the implementations of byte_range/bit_range
> get_last_byte_offset () already assume that m_size_in_bytes should be
> greater than zero. So I thi
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106830
David Malcolm changed:
What|Removed |Added
Assignee|unassigned at gcc dot gnu.org |dmalcolm at gcc dot
gnu.org
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106854
David Malcolm changed:
What|Removed |Added
CC||mir at gcc dot gnu.org
--- Comment #3 f
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106830
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|WAITING
Keywords|
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106854
--- Comment #7 from David Malcolm ---
(In reply to Alejandro Colomar from comment #6)
> timerfd_create() might not be important if the timer is not correctly
> deleted. pthread_mutex_init() is another one that is quite more important,
> as leak
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98247
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Summary|RFE: detect Flexibl
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106830
David Malcolm changed:
What|Removed |Added
Status|WAITING |RESOLVED
Resolution|---
|UNCONFIRMED |ASSIGNED
Assignee|unassigned at gcc dot gnu.org |dmalcolm at gcc dot
gnu.org
Ever confirmed|0 |1
--- Comment #1 from David Malcolm ---
Probably introduced by r13-2386-gbedfca647a9e9c1a, which added
-Wxor-used-as-pow.
Failing
: meta-bug
Severity: normal
Priority: P3
Component: c
Assignee: unassigned at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Depends on: 59850, 59851, 59852, 59856, 68524
Target Milestone: ---
I've been looking at implementing s
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
We currently have some support for parsing the insides of a printf-style format
string in two places:
* gcc/c-family/c-format.cc
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=59850
David Malcolm changed:
What|Removed |Added
Assignee|unassigned at gcc dot gnu.org |dmalcolm at gcc dot
gnu.org
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107060
David Malcolm changed:
What|Removed |Added
Status|UNCONFIRMED |ASSIGNED
Ever confirmed|0
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107060
--- Comment #2 from David Malcolm ---
Confirmed: the test case on a release build of trunk on my development box:
-O2 without -fanalyzer takes ~18 seconds
-O2 with -fanalyzer takes ~10 minutes == ~600 seconds
2401 - 2500 of 3524 matches
Mail list logo
