https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111305
Bug ID: 111305
Summary: GCC Static Analyzer -Wanalyzer-out-of-bounds FP and
ICE problem
Product: gcc
Version: 14.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: geoffreydgr at icloud dot com
Target Milestone: ---
ICE bug when analyzing the folowing program. And there also is a FP report of
out-of-bounds.
cmd: gcc -O0 -fanalyzer
gcc version: x86-64 gcc (trunk)
see it live:
https://godbolt.org/z/qKxde131e
```
#include <stdio.h>
#include <stdint.h>
struct a {
uint32_t b;
};
union c {
int8_t b;
};
int32_t *d( int32_t *j, int32_t k, struct a l) {
int64_t m[1]= {0};
for (l.b = 0; l.b <= 0; l.b++) {
printf("FLAG\n");
l.b == 12 && m[l.b];
}
}
```
out:
```
<source>: In function 'd':
<source>:15:19: warning: stack-based buffer over-read [CWE-121]
[-Wanalyzer-out-of-bounds]
15 | l.b == 12 && m[l.b];
| ~^~~~~
'd': events 1-10
|
| 12 | int64_t m[1]= {0};
| | ^
| | |
| | (1) capacity: 8 bytes
| 13 | for (l.b = 0; l.b <= 0; l.b++) {
| | ~~~~~~~~
| | |
| | (2) following 'true' branch...
| | (6) following 'true' branch...
| 14 | printf("FLAG\n");
| | ~~~~~~~~~~~~~~~~
| | |
| | (3) ...to here
| | (7) ...to here
| 15 | l.b == 12 && m[l.b];
| | ~~~~~~~~~~~~~~~~~~~
| | | | |
| | | | (9) ...to here
| | | (10) read of 8 bytes at offset 'l.b * 8' exceeds
'm'
| | (4) following 'false' branch...
| | (5) ...to here
| | (8) following 'true' branch...
|
<source>:15:19: note: valid subscripts for 'm' are '[0]' to '[0]'
15 | l.b == 12 && m[l.b];
| ~^~~~~
during IPA pass: analyzer
<source>:15:15: internal compiler error: in decompose, at wide-int.h:990
15 | l.b == 12 && m[l.b];
| ~~~~~~~~~~^~~~~~~~~
0x21af71e internal_error(char const*, ...)
???:0
0x9dd814 fancy_abort(char const*, int, char const*)
???:0
0x185a343 tree_zero_one_valued_p(tree_node*)
???:0
0x214b222 generic_simplify_MULT_EXPR(unsigned int, tree_code, tree_node*,
tree_node*, tree_node*)
???:0
0xce1d05 fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
???:0
0xce96cd fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
???:0
0x18f3716 generic_simplify_23(unsigned int, tree_node*, tree_node*, tree_node*,
tree_node**, tree_code)
???:0
0x186889c generic_simplify_PLUS_EXPR(unsigned int, tree_code, tree_node*,
tree_node*, tree_node*)
???:0
0xce1d05 fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
???:0
0xce96cd fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
???:0
0x21505bf generic_simplify_MULT_EXPR(unsigned int, tree_code, tree_node*,
tree_node*, tree_node*)
???:0
0xce1d05 fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
???:0
0xce96cd fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
???:0
0x14d2c3f ana::region_offset::calc_symbolic_bit_offset(ana::region_model
const&) const
???:0
0x217faff ana::access_range::get_size(ana::region_model const&,
ana::bit_size_expr*) const
???:0
0x218cad3 ana::access_diagram_impl::access_diagram_impl(ana::access_operation
const&, diagnostic_event_id_t, text_art::style_manager&, text_art::theme
const&, ana::logger*)
???:0
0x2180abb ana::access_diagram::access_diagram(ana::access_operation const&,
diagnostic_event_id_t, text_art::style_manager&, text_art::theme const&,
ana::logger*)
???:0
0x2111f43 ana::symbolic_buffer_over_read::emit(rich_location*, ana::logger*)
???:0
0x2139d1e ana::diagnostic_manager::emit_saved_diagnostic(ana::exploded_graph
const&, ana::saved_diagnostic&)
???:0
0x213a520 ana::diagnostic_manager::emit_saved_diagnostics(ana::exploded_graph
const&)
???:0
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
Compiler returned: 1
```
