[Bug libstdc++/91856] New: std::list::remove(const T& value) is broken with -D_GLIBCXX_DEBUG when value is a reference inside the list

[kp.lehrmann+gcc at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91856

Bug ID: 91856
   Summary: std::list::remove(const T& value) is broken with
-D_GLIBCXX_DEBUG when value is a reference inside the
list
   Product: gcc
   Version: 8.3.0
Status: UNCONFIRMED
  Severity: normal
  Priority: P3
 Component: libstdc++
  Assignee: unassigned at gcc dot gnu.org
  Reporter: kp.lehrmann+gcc at gmail dot com
  Target Milestone: ---

Created attachment 46909
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=46909&action=edit
preprocessed file

Hi,

I believe this is https://gcc.gnu.org/bugzilla/show_bug.cgi?id=17012 for
_GLIBCXX_DEBUG.

---
#define _GLIBCXX_DEBUG
#include 

main() {
std::list l{1, 2, 3};
l.remove(*l.begin());
return 0;
}
---

Address sanitizer would report a use after free:
> LANG=C g++ -v -save-temps a.cpp  -g  -fsanitize=undefined -fsanitize=address 
> && ./a.out
Using built-in specs.
COLLECT_GCC=g++
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/8/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 8.3.0-6'
--with-bugurl=file:///usr/share/doc/gcc-8/README.Bugs
--enable-languages=c,ada,c++,go,brig,d,fortran,objc,obj-c++ --prefix=/usr
--with-gcc-major-version-only --program-suffix=-8
--program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id
--libexecdir=/usr/lib --without-included-gettext --enable-threads=posix
--libdir=/usr/lib --enable-nls --enable-bootstrap --enable-clocale=gnu
--enable-libstdcxx-debug --enable-libstdcxx-time=yes
--with-default-libstdcxx-abi=new --enable-gnu-unique-object
--disable-vtable-verify --enable-libmpx --enable-plugin --enable-default-pie
--with-system-zlib --with-target-system-zlib --enable-objc-gc=auto
--enable-multiarch --disable-werror --with-arch-32=i686 --with-abi=m64
--with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic
--enable-offload-targets=nvptx-none --without-cuda-driver
--enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu
--target=x86_64-linux-gnu
Thread model: posix
gcc version 8.3.0 (Debian 8.3.0-6) 
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-g' '-fsanitize=undefined'
'-fsanitize=address' '-shared-libgcc' '-mtune=generic' '-march=x86-64'
 /usr/lib/gcc/x86_64-linux-gnu/8/cc1plus -E -quiet -v -imultiarch
x86_64-linux-gnu -D_GNU_SOURCE a.cpp -mtune=generic -march=x86-64
-fsanitize=undefined -fsanitize=address -g -fworking-directory -fpch-preprocess
-o a.ii
ignoring duplicate directory "/usr/include/x86_64-linux-gnu/c++/8"
ignoring nonexistent directory "/usr/local/include/x86_64-linux-gnu"
ignoring nonexistent directory
"/usr/lib/gcc/x86_64-linux-gnu/8/../../../../x86_64-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:
 /usr/include/c++/8
 /usr/include/x86_64-linux-gnu/c++/8
 /usr/include/c++/8/backward
 /usr/lib/gcc/x86_64-linux-gnu/8/include
 /usr/local/include
 /usr/lib/gcc/x86_64-linux-gnu/8/include-fixed
 /usr/include/x86_64-linux-gnu
 /usr/include
End of search list.
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-g' '-fsanitize=undefined'
'-fsanitize=address' '-shared-libgcc' '-mtune=generic' '-march=x86-64'
 /usr/lib/gcc/x86_64-linux-gnu/8/cc1plus -fpreprocessed a.ii -quiet -dumpbase
a.cpp -mtune=generic -march=x86-64 -auxbase a -g -version -fsanitize=undefined
-fsanitize=address -o a.s
GNU C++14 (Debian 8.3.0-6) version 8.3.0 (x86_64-linux-gnu)
compiled by GNU C version 8.3.0, GMP version 6.1.2, MPFR version 4.0.2,
MPC version 1.1.0, isl version isl-0.20-GMP

GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
GNU C++14 (Debian 8.3.0-6) version 8.3.0 (x86_64-linux-gnu)
compiled by GNU C version 8.3.0, GMP version 6.1.2, MPFR version 4.0.2,
MPC version 1.1.0, isl version isl-0.20-GMP

GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
Compiler executable checksum: 3c854693d01dc9a844a56a0b1ab1c0f4
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-g' '-fsanitize=undefined'
'-fsanitize=address' '-shared-libgcc' '-mtune=generic' '-march=x86-64'
 as -v --64 -o a.o a.s
GNU assembler version 2.31.1 (x86_64-linux-gnu) using BFD version (GNU Binutils
for Debian) 2.31.1
COMPILER_PATH=/usr/lib/gcc/x86_64-linux-gnu/8/:/usr/lib/gcc/x86_64-linux-gnu/8/:/usr/lib/gcc/x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/8/:/usr/lib/gcc/x86_64-linux-gnu/
LIBRARY_PATH=/usr/lib/gcc/x86_64-linux-gnu/8/:/usr/lib/gcc/x86_64-linux-gnu/8/../../../x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/

[Bug c/66341] New: Some casts wrongly produce a lvalue

[kp.lehrmann+gcc at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66341

Bug ID: 66341
   Summary: Some casts wrongly produce a lvalue
   Product: gcc
   Version: 5.1.0
Status: UNCONFIRMED
  Severity: minor
  Priority: P3
 Component: c
  Assignee: unassigned at gcc dot gnu.org
  Reporter: kp.lehrmann+gcc at gmail dot com
  Target Milestone: ---

Created attachment 35653
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=35653&action=edit
gcc compiles ok instead of producing a "error: lvalue required as left operand
of assignment"

Hello,

gcc (any version that I tried) allows some casts to produce a lvalue, whereas
"error: lvalue required as left operand of assignment" would be expected.

Basically, cast of the following form wrongly compile:

struct B{ int *c;};
struct A{ struct B b;};
struct A  a;

int d = 5;
(int*)((struct A *)(&a)->b.c) = &d;

Note that if the first cast (int*) is replaced by a cast to any type but the
type of the member in struct B, the expected error message is produced.

For instance, 
(char*)((struct A *)(&a)->b.c) = &d;
produce the expected error.

Best regards