[Bug analyzer/126885] New: analyzer warns about CSWTCH overflow that is not possible due to previously matched case labels

[collin.funk1 at gmail dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126885

            Bug ID: 126885
           Summary: analyzer warns about CSWTCH overflow that is not
                    possible due to previously matched  case labels
           Product: gcc
           Version: 16.1.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: collin.funk1 at gmail dot com
  Target Milestone: ---

Here is my system information:

```
$ uname -a;
Linux fedora 7.1.7-200.fc44.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Aug  6 21:13:02
UTC 2026 x86_64 GNU/Linux
$ gcc -v
Using built-in specs.
COLLECT_GCC=/usr/bin/gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-redhat-linux/16/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none:amdgcn-amdhsa
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-redhat-linux
Configured with: ../configure --enable-bootstrap
--enable-languages=c,c++,fortran,objc,obj-c++,ada,go,d,m2,cobol,algol68,lto
--prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info
--with-bugurl=https://bugzilla.redhat.com/ --enable-shared
--enable-threads=posix --enable-checking=release --enable-multilib
--with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions
--enable-gnu-unique-object --enable-linker-build-id
--with-gcc-major-version-only --enable-libstdcxx-backtrace
--with-libstdcxx-zoneinfo=/usr/share/zoneinfo --with-linker-hash-style=gnu
--enable-plugin --enable-initfini-array
--with-isl=/builddir/build/BUILD/gcc-16.1.1-build/gcc-16.1.1-20260515/obj-x86_64-redhat-linux/isl-install
--enable-offload-targets=nvptx-none,amdgcn-amdhsa --enable-offload-defaulted
--without-cuda-driver --enable-gnu-indirect-function --enable-cet
--with-tune=generic --with-tls=gnu2 --with-arch_32=i686
--build=x86_64-redhat-linux --with-build-config=bootstrap-lto
--enable-link-serialization=1 --disable-libssp
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 16.1.1 20260515 (Red Hat 16.1.1-2) (GCC)
```

Here is some code extracted from GNU coreutils lib/stdbuf.c where I noticed
this, along with the resulting warning from analyzer:

```
$ cat test.c 
static int
optc_to_fileno (int c)
{
  int ret = -1;

  switch (c)
    {
    case 'e':
      ret = 2;
      break;
    case 'i':
      ret = 0;
      break;
    case 'o':
      ret = 1;
      break;
    }

  return ret;
}
int
main (int argc, char *argv)
{
  char c = argv[argc - 1];
  switch (c)
    {
    case 'e':
    case 'i':
    case 'o':
      {
        int value = optc_to_fileno (c);
        return value;
      }
    }
}
$ gcc -fdiagnostics-plain-output -O2 -fanalyzer test.c 
In function ‘optc_to_fileno’,
    inlined from ‘main’ at test.c:31:21:
test.c:6:3: warning: buffer over-read [CWE-787] [-Wanalyzer-out-of-bounds]
test.c: In function ‘main’:
test.c:22:1: note: (1) entry to ‘main’
test.c:25:3: note: (2) following ‘case 101:, case 105:, case 111:’ branch...
test.c:31:21: note: (3) inlined call to ‘optc_to_fileno’ from ‘main’
In function ‘optc_to_fileno’,
    inlined from ‘main’ at test.c:31:21:
test.c:6:3: note: (4) ...to here
test.c:6:3: note: (5) out-of-bounds read on ‘CSWTCH’
test.c:6:3: note: valid subscripts for ‘CSWTCH’ are ‘[0]’ to ‘[10]’
```

Note that adding a "default: unreachable ();" to the switch statement in
optc_to_fileno pacifies the warning. So it seems analyzer is not able to
determine that on it's own in this case.