On 6/2/20 6:12 PM, Martin Sebor via Gcc-patches wrote:
The compute_objsize() function started out as a thin wrapper around
compute_builtin_object_size(), but over time developed its own
features to compensate for the other function's limitations (such
as its inability to work with ranges). The interaction of these
features and the limitations has started to become increasingly
problematic as the former function is used in more contexts.
A complete "fix" for all the problems (as well as some other
limitations) that I'm working on will be more extensive and won't
be appropriate for backports. Until then, the attached patch
cleans up the extensions compute_objsize() has accumulated over
the years to avoid a class of false positives.
To make the warnings issued based on the results of the function
easier to understand and fix, the patch also adds an informative
message to many instances of -Wstringop-overflow to point to
the object to which the warning refers. This is especially
helpful when the object is referenced by a series of pointer
operations.
Tested by boostrapping on x86_64-linux and building Binutils/GDB,
Glibc, and the Linux kernel with no new warnings.
Besides applying it to trunk I'm looking to backport the fix to
GCC 10.
This patch (commit a2c2cee92e5defff9bf23d3b1184ee96e57e5fdd) has broken
glibc builds on nios2-linux-gnu, when building sysdeps/posix/getaddrinfo.c:
../sysdeps/posix/getaddrinfo.c: In function 'gaih_inet.constprop':
../sysdeps/posix/getaddrinfo.c:1081:3: error: 'memcpy' writing 16 bytes
into a region of size 8 overflows the destination
[-Werror=stringop-overflow=]
1081 | memcpy (&sin6p->sin6_addr,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
1082 | at2->addr, sizeof (struct in6_addr));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../include/netinet/in.h:3,
from ../resolv/bits/types/res_state.h:5,
from ../include/bits/types/res_state.h:1,
from ../nptl/descr.h:35,
from ../sysdeps/nios2/nptl/tls.h:45,
from ../sysdeps/generic/libc-tsd.h:44,
from ../include/../locale/localeinfo.h:224,
from ../include/ctype.h:26,
from ../sysdeps/posix/getaddrinfo.c:57:
../inet/netinet/in.h:249:19: note: destination object 'sin_zero'
249 | unsigned char sin_zero[sizeof (struct sockaddr)
| ^~~~~~~~
I have to say that I don't understand the "note" diagnostic here at all.
:-( Why does it think the destination object is a field of struct
sockaddr_in, while this memcpy is filling in a field of struct
sockaddr_in6? (And, the sin6_addr field is indeed of type struct
in6_addr, matching the sizeof expression.)
-Sandra the confused
