https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105736

--- Comment #2 from Siddhesh Poyarekar <siddhesh at gcc dot gnu.org> ---
OK, so the fix is pretty straightforward; error_mark_node escapes through as a
return in ADDR_EXPR object size computations.  I want to get a reproducer
independent of ubsan though so that it's verifiable in the general case:

diff --git a/gcc/tree-object-size.cc b/gcc/tree-object-size.cc
index fc062b94d76..f1a699a94db 100644
--- a/gcc/tree-object-size.cc
+++ b/gcc/tree-object-size.cc
@@ -695,19 +695,24 @@ addr_object_size (struct object_size_info *osi,
const_tree ptr,
        var_size = pt_var_size;
       bytes = compute_object_offset (TREE_OPERAND (ptr, 0), var);
       if (bytes != error_mark_node)
-       bytes = size_for_offset (var_size, bytes);
-      if (var != pt_var
-         && pt_var_size
-         && TREE_CODE (pt_var) == MEM_REF
-         && bytes != error_mark_node)
        {
-         tree bytes2 = compute_object_offset (TREE_OPERAND (ptr, 0), pt_var);
-         if (bytes2 != error_mark_node)
+         bytes = size_for_offset (var_size, bytes);
+         if (var != pt_var
+             && pt_var_size
+             && TREE_CODE (pt_var) == MEM_REF
+             && bytes != error_mark_node)
            {
-             bytes2 = size_for_offset (pt_var_size, bytes2);
-             bytes = size_binop (MIN_EXPR, bytes, bytes2);
+             tree bytes2 = compute_object_offset (TREE_OPERAND (ptr, 0),
+                                                  pt_var);
+             if (bytes2 != error_mark_node)
+               {
+                 bytes2 = size_for_offset (pt_var_size, bytes2);
+                 bytes = size_binop (MIN_EXPR, bytes, bytes2);
+               }
            }
        }
+      else
+       bytes = size_unknown (object_size_type);

       wholebytes
        = object_size_type & OST_SUBOBJECT ? var_size : pt_var_wholesize;

Reply via email to