https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111839
Jakub Jelinek <jakub at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jakub at gcc dot gnu.org
--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Slightly cleaned up.
long a, *d, *h;
int b, c, e, g, i;
signed char f = -26;
int
main ()
{
long j;
for (c = 0; c != 7; ++c)
{
long k = 0;
long l = k;
long **m = &d;
for (; f + i != 0; i++)
h = &l;
g = h != (*m = &j);
int *n = &b;
*n = g;
while (e)
while (a)
++a;
}
if (b != 1)
__builtin_abort ();
}
I'd say this is just invalid code.
In the c == 0 iteration, h is set to address of l, local in the loop (many
times).
But when that l var goes out of the scope at the end of the iteration, the h
pointer pointing to it becomes invalid, it doesn't point to any valid object.
In the c == 1 iteration, it isn't reinitialized, so I think using it for the
comparison is UB.
ASan use-after-scope can't catch such sort of thing, it can catch stuff when
such pointer is dereferenced, but that is not the case here. Plus, when l
starts lifetime in the c == 1 and later iterations, it would be unpoisoned
again and nothing would be reported even if it was dereferenced.
This is essentially
int *p;
int
main ()
{
for (int i = 0; i < 10; ++i)
{
int l = 0;
if (i == 0)
p = &l;
*p = 42;
}
}
which isn't reported with -fsanitize=address -fsanitize-address-use-after-scope
-g
by either gcc or clang, yet is clearly undefined behavior. The earlier
testcase
doesn't dereference but IMHO has the same problem.
