: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
-Wanalyzer-tainted-divisor seems to be using the wrong logic for determining if
a value has been checked for zeroness; consider:
#include
struct st1
{
int a;
int
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106225
David Malcolm changed:
What|Removed |Added
Last reconfirmed||2022-07-07
Status|UNCONFIRM
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106225
--- Comment #3 from David Malcolm ---
Fixed on trunk for gcc 13 by the above commit. Keeping this open to backport
to gcc 12.
: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
Consider:
struct s_12
{
unsigned char idx;
char buf[256];
};
char __attribute__((tainted_args))
test_12(struct
: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
CWE-617: Reachable Assertion:
https://cwe.mitre.org/data/definitions/617.html
"The product contains an assert
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106235
--- Comment #1 from David Malcolm ---
Juliet 1.3 has various testcases for this in
C/testcases/CWE617_Reachable_Assertion/
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96032
--- Comment #4 from David Malcolm ---
I posted a prototype implementation of this here:
"[PATCH 00/12] RFC: Replay of serialized diagnostics"
https://gcc.gnu.org/pipermail/gcc-patches/2022-June/597051.html
(doesn't fully work; see the many
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91733
David Malcolm changed:
What|Removed |Added
CC||dmalcolm at gcc dot gnu.org
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106272
--- Comment #9 from David Malcolm ---
Thanks!
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 106003
Target Milestone: ---
As noted here:
https://sourceware.org/pipermail/libc-alpha/2022-July/140623.html
and
https://sourceware.org/pipermail/libc-alpha/2022
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
Consider:
#define LOWER_LIMIT 5
#define UPPER_LIMIT 10
static int arr[UPPER_LIMIT];
static int
called_by_test_1
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 106003
Target Milestone: ---
A minor nit: I added pending_diagnostic::get_meaning_for_state_change after
Immad started working on sm
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106286
--- Comment #1 from David Malcolm ---
Compare with e.g.:
gcc/testsuite/gcc.dg/analyzer/file-meaning-1.c
which tests this for the sm-file.cc
: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 106003
Target Milestone: ---
Now that -fanalyzer has warnings for file descriptors (especially leaks), we
should probably special-case the following functions (rather than
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 106003
Target Milestone: ---
Now that the analyzer supports checking both filedescriptor *and* FILE * usage,
we should probably add special-case handling of fdopen:
https://www.man7
: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 106003
Target Milestone: ---
Currently -fanalyzer special-cases "open" for obtaining a possibly-open file
descrip
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 106003
Target Milestone: ---
Now that the analyzer can track uses of file-descriptors, we may want to
special-case mmap:
https://www.man7.org/linux/man-pages/man2/mmap.2.html
void
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106301
--- Comment #1 from David Malcolm ---
Potentially we could also track the allocated region, and complain if it is
leaked. I think this would require handling of mmap/munmap in sm-malloc.cc (so
that we can detect leaks), and support in the regio
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 106003, 106301
Target Milestone: ---
As noted in the discussion here:
https://gcc.gnu.org/pipermail/gcc/2022-June/238954.html
-fanalyzer sometimes uses specific
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106284
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Status|UNCONFIRMED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106284
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
Consider e.g.:
static void __attribute__((noinline))
__analyzer_consume_n_ints (int num, ...)
{
__builtin_va_list ap
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106312
--- Comment #1 from David Malcolm ---
Seems to work for me (on gcc112); is there a particular machine you tried this
on?
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
Consider: https://godbolt.org/z/o3xE7PozM
static int arr[100];
int __attribute__((tainted_args))
test_5 (int
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106325
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Status|UNCONFIRMED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106321
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|UNCONFIRMED
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Depends on: 106204, 106218, 106225, 106229, 106319, 106284, 106321
Target Milestone: ---
I've creating this tracker bug to help org
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 106358
Target Milestone: ---
I've been testing -fanalyzer trunk with my trust boundaries patches on the
ups
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106359
--- Comment #1 from David Malcolm ---
Dumping the store shows huge numbers of clusters of the form:
cluster for: "RXANCL Input": CONJURED(madera_free_bus_error_irq (_6, i_29);,
"RXANCL Input") (ESCAPED) (TOUCHED)
cluster for: "Route": CONJU
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106359
David Malcolm changed:
What|Removed |Added
Status|UNCONFIRMED |RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106358
Bug 106358 depends on bug 106359, which changed state.
Bug 106359 Summary: -fanalyzer takes a very long time on Linux kernel:
sound/soc/codecs/cs47l{85,90}.c
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106359
What|Removed
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100244
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|ASSIGNED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100615
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|ASSIGNED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99212
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101386
--- Comment #1 from David Malcolm ---
Thanks for filing this bug.
The:
__attribute__((malloc, malloc(string_delete)))
is confusing the analyzer; if I remove it, the code compiles without warnings.
I'm not yet sure what the analyzer should do
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94713
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95006
Bug 95006 depends on bug 94713, which changed state.
Bug 94713 Summary: Analyzer is buggy on uninitialized pointer
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94713
What|Removed |Added
-
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94714
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95006
Bug 95006 depends on bug 94714, which changed state.
Bug 94714 Summary: Analyzer: no warning on access of an uninitialized variable
of automatic storage duration
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94714
What|Removed
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95006
David Malcolm changed:
What|Removed |Added
Status|UNCONFIRMED |RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101491
--- Comment #2 from David Malcolm ---
I wonder why this changed recently; as Dimitry notes, this has been done the
same since the initial merger of libgccjit into trunk.
I'm using $(includedir). What should I be using? Thanks
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101503
David Malcolm changed:
What|Removed |Added
Last reconfirmed||2021-07-19
Status|UNCONFIRM
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101503
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101522
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Last reconfirmed|
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101550
--- Comment #1 from David Malcolm ---
Thanks for filing this bug.
What version of glibc are you using?
This looks similar to PR 101081 in that I think it's dependent on the exact
uses of __attribute__((malloc)) within stdio.h.
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101522
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101547
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|UNCONFIRMED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101570
David Malcolm changed:
What|Removed |Added
Last reconfirmed||2021-07-22
Status|UNCONFIRM
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101570
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
Severity: normal
Priority: P3
Component: ipa
Assignee: unassigned at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
CC: marxin at gcc dot gnu.org
Target Milestone: ---
I'm attaching a reduced reproducer for an issue seen
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101941
--- Comment #1 from David Malcolm ---
Created attachment 51311
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51311&action=edit
Reduced reproducer
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101941
David Malcolm changed:
What|Removed |Added
Summary|Linux kernel build failure |[12 Regression] Linux
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101941
--- Comment #5 from David Malcolm ---
Other ideas for fixing:
(a) (hackish workaround?): defer emitting diagnostics from
__attribute__((__error__)) and __attribute__((__warning__)) until a
postprocessing stage, after all functions have been emi
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
-fanalyzer emits two warnings on this code:
#define NULL ((void *)0)
int *
func1(int *ptr) {
if (!ptr)
return NULL;
return ++ptr;
}
int
main() {
int
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101962
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Status|UNCONFIRMED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101875
David Malcolm changed:
What|Removed |Added
Status|NEW |ASSIGNED
--- Comment #2 from David Malc
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101837
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Status|UNCONFIRMED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101980
David Malcolm changed:
What|Removed |Added
Status|UNCONFIRMED |NEW
Last reconfirmed|
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
-fanalyzer reports various "leak" false positives on the foll
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101875
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|ASSIGNED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101837
David Malcolm changed:
What|Removed |Added
Resolution|--- |FIXED
Status|ASSIGNED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101962
--- Comment #3 from David Malcolm ---
Should be fixed on trunk for gcc 12 by the above commit.
I plan to backport this to gcc 11; keeping it open until that's done.
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93090
--- Comment #4 from David Malcolm ---
FWIW there's also:
https://github.com/antoyo/rustc_codegen_gcc
which isn't a GCC Rust frontend per se, but uses libgccjit to embed GCC as a
code generation backend inside the existing rustc compiler (I'm th
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96032
David Malcolm changed:
What|Removed |Added
CC||dmalcolm at gcc dot gnu.org
Last
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110090
--- Comment #1 from David Malcolm ---
Thanks for filing this bug report, and sorry for not responding before.
Are you still able to reproduce this?
If so, please can you use -save-temps to generated a preprocessed file (.i)
that reproduces the
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111441
David Malcolm changed:
What|Removed |Added
Summary|internal compiler error: in |[14 Regression] ICE
|
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113923
--- Comment #1 from David Malcolm ---
Reproducing that is going to be a challenge.
FWIW you can probably work around it via -fno-analyzer-undo-inlining.
For an inlined_call_event's m_apparent_caller_fndecl to be NULL, then when it
was created
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113923
--- Comment #2 from David Malcolm ---
inlined_call_event's ctor should probably assert that params
tree apparent_callee_fndecl,
tree apparent_caller_fndecl,
are both non-NULL, which might catch the iss
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113923
--- Comment #3 from David Malcolm ---
(In reply to David Malcolm from comment #2)
> are both non-NULL, which might catch the issue slightly early.
^
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110907
David Malcolm changed:
What|Removed |Added
Resolution|--- |DUPLICATE
Status|UNCONFIRME
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113509
David Malcolm changed:
What|Removed |Added
CC||vultkayn at gcc dot gnu.org
--- Comment
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113606
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Summary|-Wanalyzer-infinit
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113619
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Last reconfirmed|
|1
CC||dmalcolm at gcc dot gnu.org
Last reconfirmed||2024-02-15
Summary|Missing |[13/14 Regression] Missing
|-Wanalyzer-out-of-bounds|-Wanalyzer-out-of
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111802
--- Comment #1 from David Malcolm ---
Thanks for filing this bug report.
The issue seems to be with the top line here:
┌┬┬┬┬┐┌─┬─┬─┐
│[1] │[1] │[1] │[1] │
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113505
David Malcolm changed:
What|Removed |Added
Status|UNCONFIRMED |NEW
Ever confirmed|0
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113496
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Status|UNCONFIRMED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112889
David Malcolm changed:
What|Removed |Added
Summary|ICE with -fanalyzer seen on |[11/12/13 Regression] ICE
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109191
David Malcolm changed:
What|Removed |Added
Status|UNCONFIRMED |RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109131
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Status|UNCONFIRMED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110928
David Malcolm changed:
What|Removed |Added
Last reconfirmed||2024-02-15
Status|UNCONFIRM
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112975
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Status|UNCONFIRMED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112974
David Malcolm changed:
What|Removed |Added
Last reconfirmed||2024-02-15
Ever confirmed|0
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109577
David Malcolm changed:
What|Removed |Added
Last reconfirmed||2024-02-15
Ever confirmed|0
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110014
David Malcolm changed:
What|Removed |Added
Last reconfirmed||2024-02-15
Ever confirmed|0
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111229
--- Comment #1 from David Malcolm ---
Thanks for filing this.
Probably a duplicate of PR 100116.
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111266
David Malcolm changed:
What|Removed |Added
Summary|[13/14 Regression] Missing |[13 Regression] Missing
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111289
David Malcolm changed:
What|Removed |Added
Summary|Unwarranted |[13/14 Regression]
|-
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113314
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Status|UNCONFIRMED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109251
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Status|UNCONFIRMED
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105961
David Malcolm changed:
What|Removed |Added
Status|ASSIGNED|RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108400
David Malcolm changed:
What|Removed |Added
Ever confirmed|0 |1
Last reconfirmed|
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105755
--- Comment #3 from David Malcolm ---
Current status of reproducer on Compiler Explorer:
GCC trunk: no warning: https://godbolt.org/z/o6ecKKa8e
GCC 13.2: no warning: https://godbolt.org/z/z7hdYx1Y7
GCC 12.3: false +ve: https://godbolt.o
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108562
Bug 108562 depends on bug 105755, which changed state.
Bug 105755 Summary: -Wanalyzer-null-dereference regression compiling Emacs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105755
What|Removed |Added
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105755
David Malcolm changed:
What|Removed |Added
Resolution|--- |WORKSFORME
Status|UNCONFIRM
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111213
David Malcolm changed:
What|Removed |Added
Status|NEW |SUSPENDED
--- Comment #4 from David Mal
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109628
David Malcolm changed:
What|Removed |Added
Resolution|--- |WORKSFORME
Status|UNCONFIRM
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109579
David Malcolm changed:
What|Removed |Added
Status|UNCONFIRMED |RESOLVED
Resolution|---
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109851
David Malcolm changed:
What|Removed |Added
Summary|False positive va_arg when |[13/14 Regression] False
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110285
David Malcolm changed:
What|Removed |Added
Last reconfirmed||2024-02-16
Ever confirmed|0
2801 - 2900 of 3524 matches
Mail list logo
