Below are a few C test cases from my tests for the solution for pr90404 that I noticed the analyzer doesn't issue warnings for but could and probably should. $ cat z.c && gcc -S -Wall -fanalyzer z.c extern void* malloc (__SIZE_TYPE__); const char* write_strchr_literal (int x) { char *p = __builtin_strchr ("123", x); *p = 0; // missing warning return p; } const char* write_strchr_const_array (int x) { static const char a[] = "123"; char *p = __builtin_strchr (a, x); *p = 0; // missing warning return a; } char* write_function (void) { char *p = (char*)malloc /* forgot arguments */; __builtin_strcpy (p, "123"); // missing warning return p; } char* write_label (void) { char *p = (char*)&&L; *p = 0; // missing warning L: return p; } struct A { const int i; }; extern /* not const */ struct A a; void write_const_member (void) { char *p = (char*)&a.i; *p = 0; // missing warning }
Am testing a fix
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>: https://gcc.gnu.org/g:111fd515f2894d7cddf62f80c69765c43ae18577 commit r12-5330-g111fd515f2894d7cddf62f80c69765c43ae18577 Author: David Malcolm <dmalcolm@redhat.com> Date: Tue Nov 16 10:36:49 2021 -0500 analyzer: fix missing -Wanalyzer-write-to-const [PR102695] This patch fixes -Wanalyzer-write-to-const so that it will complain about attempts to write to functions, to labels. It also "teaches" the analyzer about strchr, in that strchr can either return a pointer into the input area (and thus -Wanalyzer-write-to-const can now complain about writes into a string literal seen this way), or return NULL (and thus the analyzer can complain about NULL dereferences if the result is used without a check). gcc/analyzer/ChangeLog: PR analyzer/102695 * region-model-impl-calls.cc (region_model::impl_call_strchr): New. * region-model-manager.cc (region_model_manager::maybe_fold_unaryop): Simplify cast to pointer type of an existing pointer to a region. * region-model.cc (region_model::on_call_pre): Handle BUILT_IN_STRCHR and "strchr". (write_to_const_diagnostic::emit): Add auto_diagnostic_group. Add alternate wordings for functions and labels. (write_to_const_diagnostic::describe_final_event): Add alternate wordings for functions and labels. (region_model::check_for_writable_region): Handle RK_FUNCTION and RK_LABEL. * region-model.h (region_model::impl_call_strchr): New decl. gcc/testsuite/ChangeLog: PR analyzer/102695 * gcc.dg/analyzer/pr102695.c: New test. * gcc.dg/analyzer/strchr-1.c: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
The above patch implements detection for all of the cases in comment #0 apart from write_const_member; I don't plan to implement detection of that, so marking this as resolved.