when i try to use taint checher to handle the following case, i encouter an error. ```c __attribute__ ((tainted_args)) double divide(double x, double y){ return x/y; } ``` cmd: gcc -fanalyzer --analyzer-checker=taint cwe-369.c -c error messages: " // Target: x86_64-pc-linux-gnu // Configured with: ../gcc/configure -prefix=/usr/local/gcc-13-9533 --enable-checking=release --enable-languages=c,c++ --disable-multilib // Thread model: posix // Supported LTO compression algorithms: zlib // gcc version 13.1.1 20230717 (GCC) // // during IPA pass: analyzer // CWE/cwe-369.c: In function 'divide': // CWE/cwe-369.c:3:9: internal compiler error: in wide_int_to_tree_1, at tree.cc:1755 // 3 | return x/y; // | ~^~ // 0x712cea wide_int_to_tree_1 // ../../gcc/gcc/tree.cc:1755 // 0xf4187b wide_int_to_tree(tree_node*, poly_int<1u, generic_wide_int<wide_int_ref_storage<false, true> > > const&) // ../../gcc/gcc/tree.cc:1867 // 0xf4187b build_int_cst(tree_node*, poly_int<1u, long>) // ../../gcc/gcc/tree.cc:1507 // 0x1007587 ana::region_model_manager::get_or_create_int_cst(tree_node*, poly_int<1u, long>) // ../../gcc/gcc/analyzer/region-model-manager.cc:236 // 0x1028059 check_for_tainted_divisor // ../../gcc/gcc/analyzer/sm-taint.cc:1355 // 0x1028059 on_stmt // ../../gcc/gcc/analyzer/sm-taint.cc:1015 // 0xfd5dbf ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode const*, gimple const*, ana::program_state*, ana::uncertainty_t*, ana::path_context*) // ../../gcc/gcc/analyzer/engine.cc:1490 // 0xfd86bd ana::exploded_graph::process_node(ana::exploded_node*) // ../../gcc/gcc/analyzer/engine.cc:4063 // 0xfd94fa ana::exploded_graph::process_worklist() // ../../gcc/gcc/analyzer/engine.cc:3466 // 0xfdb7e7 ana::impl_run_checkers(ana::logger*) // ../../gcc/gcc/analyzer/engine.cc:6125 // 0xfdc7c6 ana::run_checkers() // ../../gcc/gcc/analyzer/engine.cc:6213 // 0xfccf68 execute // ../../gcc/gcc/analyzer/analyzer-pass.cc:87 // Please submit a full bug report, with preprocessed source. // Please include the complete backtrace with any bug report. // See <https://gcc.gnu.org/bugs/> for instructions. // /usr/local/gcc-13-9533/libexec/gcc/x86_64-pc-linux-gnu/13.1.1/cc1 -quiet -imultiarch x86_64-linux-gnu CWE/cwe-369.c -quiet -dumpbase cwe-369.c -dumpbase-ext .c -mtune=generic -march=x86-64 -fanalyzer -fanalyzer-checker=taint -freport-bug -o - -frandom-seed=0 -fdump-noaddr "
Thanks for filing this bug. Seems to affect GCC 12, 13, and trunk. Here's the reproducer on Compiler Explorer: https://godbolt.org/z/GWM1G6b3s
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>: https://gcc.gnu.org/g:b86c0fe327a5196a316bd698d12765b08de5dce7 commit r14-2658-gb86c0fe327a5196a316bd698d12765b08de5dce7 Author: David Malcolm <dmalcolm@redhat.com> Date: Wed Jul 19 17:55:09 2023 -0400 analyzer: fix ICE on division of tainted floating-point values [PR110700] gcc/analyzer/ChangeLog: PR analyzer/110700 * region-model-manager.cc (region_model_manager::get_or_create_int_cst): Assert that we have an integral or pointer type. * sm-taint.cc (taint_state_machine::check_for_tainted_divisor): Don't check non-integral types. gcc/testsuite/ChangeLog: PR analyzer/110700 * gcc.dg/analyzer/taint-divisor-2.c: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
Should be fixed on trunk by the above patch. Keeping open to track backporting to branches for gcc 12 and gcc 13.
The releases/gcc-13 branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>: https://gcc.gnu.org/g:0df1ee083434ac00ecb19582b1e5b25e105981b2 commit r13-8746-g0df1ee083434ac00ecb19582b1e5b25e105981b2 Author: David Malcolm <dmalcolm@redhat.com> Date: Thu May 9 13:09:28 2024 -0400 analyzer: fix ICE on division of tainted floating-point values [PR110700] gcc/analyzer/ChangeLog: PR analyzer/110700 * region-model-manager.cc (region_model_manager::get_or_create_int_cst): Assert that we have an integral or pointer type. * sm-taint.cc (taint_state_machine::check_for_tainted_divisor): Don't check non-integral types. gcc/testsuite/ChangeLog: PR analyzer/110700 * gcc.dg/analyzer/taint-divisor-2.c: New test. (cherry picked from commit r14-2658-gb86c0fe327a519) Signed-off-by: David Malcolm <dmalcolm@redhat.com>
Should be fixed for GCC 13 (for the upcoming GCC 13.3) by the above patch. Keeping open to track backporting to older branches.
GCC 12.4 is being released, retargeting bugs to GCC 12.5.