Bug 63426 (ubsan) - [meta-bug] Issues found with -fsanitize=undefined
Summary: [meta-bug] Issues found with -fsanitize=undefined
Status: NEW
Alias: ubsan
Product: gcc
Classification: Unclassified
Component: other (show other bugs)
Version: 5.0
: P3 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords: meta-bug
Depends on: 61905 64327 67446 68901 81603 82042 82489 82494 84950 84951 85164 85608 87042 87703 87826 88057 88239 88652 90214 90228 90241 90242 90244 98993 99202 99203 100201 100202 100206 100213 100214 100216 100229 100236 103437 104063 109788 110147 110678 114627 114663 59545 61657 61907 61908 61910 61943 62058 63397 63427 64914 64920 65261 66827 66940 82491 84416 84637 84638 84639 84640 84641 84643 84932 84945 84946 84947 85158 85167 85431 85789 86618 86644 86645 86653 87782 87787 88649 88651 89495 89496 90213 92174 92832 93162 93443 94246 95456 97379 98270 98624 98625 98626 99190 99191 99376 100204 100211 100212 100311 102019 102541 103082 103167 103229 103230 103435 104064 104842 104843 104851 104999 105056 105532 105533 106097 108278 109759 109886 110677 115876 115967 116370 116661 116810 116936
Blocks:
  Show dependency treegraph
 
Reported: 2014-10-01 09:17 UTC by Markus Trippelsdorf
Modified: 2024-10-02 11:53 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2014-10-01 00:00:00


Attachments
attachment-130925-0.dat (141 bytes, message/delivery-status)
2019-10-22 08:26 UTC, postmaster
Details
attachment-130925-1.eml (1.20 KB, message/rfc822)
2019-10-22 08:26 UTC, postmaster
Details
attachment-60399-0.dat (141 bytes, message/delivery-status)
2019-10-22 18:43 UTC, postmaster
Details
attachment-60399-1.eml (1.21 KB, message/rfc822)
2019-10-22 18:43 UTC, postmaster
Details
attachment-36069-0.dat (141 bytes, message/delivery-status)
2019-10-24 08:54 UTC, postmaster
Details
attachment-36069-1.eml (1.22 KB, message/rfc822)
2019-10-24 08:54 UTC, postmaster
Details
attachment-70446-0.dat (141 bytes, message/delivery-status)
2019-10-24 11:06 UTC, postmaster
Details
attachment-70446-1.eml (1.21 KB, message/rfc822)
2019-10-24 11:06 UTC, postmaster
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Markus Trippelsdorf 2014-10-01 09:17:10 UTC

    
Comment 1 Markus Trippelsdorf 2014-10-01 11:12:45 UTC
Here's the full list (cut down to one instance per issue) of todays trunk:

gcc/fortran/interface.c:2667:43: runtime error: load of value 1818451807, which is not a valid value for type 'expr_t'
gcc/fortran/interface.c:2908:47: runtime error: load of value 108398592, which is not a valid value for type 'ar_type'
gcc/fortran/trans-array.c:2211:9: runtime error: load of value 92, which is not a valid value for type 'bool'
gcc/fortran/trans-expr.c:2286:48: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
gcc/hwint.h:250:29: runtime error: shift exponent 64 is too large for 64-bit type 'long int'
gcc/ira.c:2465:24: runtime error: signed integer overflow: -2097715000 + -65536000 cannot be represented in type 'int'
gcc/ira.c:2472:31: runtime error: signed integer overflow: -2097600000 + -65536000 cannot be represented in type 'int'
gcc/loop-iv.c:2305:24: runtime error: signed integer overflow: 9223372036854775807 - -9223372036854775808 cannot be represented in type 'long int'
gcc/loop-iv.c:2643:14: runtime error: signed integer overflow: 9223372036854775806 - -9223372036854775808 cannot be represented in type 'long int'
gcc/tree-data-ref.c:2352:38: runtime error: signed integer overflow: 1073741824 + 1073741824 cannot be represented in type 'int'
gcc/tree-data-ref.c:2443:16: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
gcc/tree-ssa-loop-ivopts.c:4192:24: runtime error: signed integer overflow: 4 * 4611686018427387903 cannot be represented in type 'long int'
libiberty/cp-demangle.c:4074:40: runtime error: variable length array bound evaluates to non-positive value 0
libiberty/cp-demangle.c:4075:43: runtime error: variable length array bound evaluates to non-positive value 0

There are also a couple of buggy testcases:

testsuite/gcc.dg/compat/generate-random_r.c:363:19: runtime error: signed integer overflow: 1627687941 + 1735697613 cannot be represented in type 'int'
testsuite/gcc.dg/compat/struct-layout-1_generate.c:1081:13: runtime error: shift exponent 64 is too large for 64-bit type 'long long unsigned int'
testsuite/g++.dg/compat/../../gcc.dg/compat/generate-random_r.c:363:19: runtime error: signed integer overflow: 1627687941 + 1735697613 cannot be represented in type 'int'
testsuite/g++.dg/compat/struct-layout-1_generate.c:795:26: runtime error: shift exponent 64 is too large for 64-bit type 'long long unsigned int'
testsuite/g++.dg/compat/struct-layout-1_generate.c:805:13: runtime error: shift exponent 65 is too large for 64-bit type 'long long unsigned int
Comment 2 Markus Trippelsdorf 2014-11-19 12:21:45 UTC
A few new ones:

config/rs6000/constraints.md:143:33: runtime error: signed integer overflow: 9223372036854775807 + 32768 cannot be represented in type 'long int'
config/rs6000/predicates.md:396:22: runtime error: signed integer overflow: 9223372036854775807 + 2147516416 cannot be represented in type 'long int'
config/rs6000/predicates.md:856:11: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
config/rs6000/predicates.md:862:12: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
config/rs6000/predicates.md:865:11: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
config/rs6000/predicates.md:868:12: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
config/rs6000/predicates.md:914:11: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
config/rs6000/predicates.md:917:12: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
config/rs6000/predicates.md:940:11: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
config/rs6000/predicates.md:946:12: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
config/rs6000/predicates.md:949:11: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
config/rs6000/predicates.md:955:12: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
gcc.c:1687:29: runtime error: load of misaligned address 0x0000101e55f9 for type 'const char *', which requires 8 byte alignment
gcc.c:1690:25: runtime error: store to misaligned address 0x0000101e55f9 for type 'const char *', which requires 8 byte alignment
gcc.c:5596:29: runtime error: load of misaligned address 0x0000101e55d9 for type 'const char *', which requires 8 byte alignment
gcc.c:7251:15: runtime error: load of misaligned address 0x0000101e55c9 for type 'const char *', which requires 8 byte alignment
gcc.c:8003:33: runtime error: load of misaligned address 0x0000101e55f9 for type 'const char *', which requires 8 byte alignment
loop-iv.c:2314:24: runtime error: signed integer overflow: 9223372036854775807 - -9223372036854775808 cannot be represented in type 'long int'
loop-iv.c:2652:14: runtime error: signed integer overflow: 9223372036854775806 - -9223372036854775808 cannot be represented in type 'long int'
varasm.c:7191:16: runtime error: shift exponent 63 is too large for 32-bit type 'int'
Comment 3 Markus Trippelsdorf 2014-11-20 10:24:25 UTC
I've added -fno-sanitize=alignment to bootstrap-ubsan.mk, otherwise 
libstdc++ wouldn't build (due to the gcc.c problem in comment 2). 

Here are the results of a testsuite run (cut down to one instance per issue):



gcc/c/c-typeck.c:8126:42: runtime error: load of address 0x3fffca8782e0 with insufficient space for an object of type 'long int'
gcc/config/rs6000/constraints.md:179:37: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
gcc/config/rs6000/predicates.md:411:21: runtime error: signed integer overflow: 9223372036854775807 + 2147516416 cannot be represented in type 'long int'
gcc/config/rs6000/rs6000.c:16207:15: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
gcc/config/rs6000/rs6000.c:16210:16: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
gcc/config/rs6000/rs6000.c:16220:15: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
gcc/config/rs6000/rs6000.c:16221:16: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
gcc/config/rs6000/rs6000.c:16243:15: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
gcc/config/rs6000/rs6000.c:16251:16: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int'; cast to an unsigned type to negate this value to itself
gcc/config/rs6000/rs6000.c:5086:39: runtime error: signed integer overflow: 9223372036854775806 + 32768 cannot be represented in type 'long int'
gcc/emit-rtl.c:210:39: runtime error: signed integer overflow: -9223372034707292160 + -9223372034707292160 cannot be represented in type 'long int'
gcc/expmed.c:2987:42: runtime error: signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long int'
gcc/fortran/data.c:181:32: runtime error: null pointer passed as argument 2, which is declared to never be null
gcc/fortran/interface.c:2667:43: runtime error: load of value 1600086892, which is not a valid value for type 'expr_t'
gcc/fortran/interface.c:2908:47: runtime error: load of value 256, which is not a valid value for type 'ar_type'
gcc/fortran/module.c:2348:28: runtime error: load of value 256, which is not a valid value for type 'bt'
gcc/fortran/trans-expr.c:2286:48: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int [3]'; cast to an unsigned type to negate this value to itself
gcc/fortran/trans-expr.c:5280:19: runtime error: member call on null pointer of type 'struct vec'
gcc/fortran/trans-expr.c:5283:19: runtime error: member call on null pointer of type 'struct vec'
gcc/fortran/trans-expr.c:5286:19: runtime error: member call on null pointer of type 'struct vec'
gcc/gcov-io.c:376:38: runtime error: null pointer passed as argument 2, which is declared to never be null
gcc/hwint.h:250:19: runtime error: shift exponent 64 is too large for 64-bit type 'long int'
gcc/ipa-prop.c:2435:30: runtime error: member call on null pointer of type 'struct ipa_polymorphic_call_context'
gcc/ira-costs.c:1303:57: runtime error: null pointer passed as argument 2, which is declared to never be null
gcc/loop-iv.c:2652:14: runtime error: signed integer overflow: 499 - -9223372036854775808 cannot be represented in type 'long int'
gcc/simplify-rtx.c:5074:10: runtime error: shift exponent -64 is negative
gcc/tree-data-ref.c:2363:38: runtime error: signed integer overflow: 1073741824 + 1073741824 cannot be represented in type 'int'
gcc/tree-data-ref.c:2452:16: runtime error: signed integer overflow: 131072 * -131072 cannot be represented in type 'int'
gcc/tree-data-ref.c:2453:16: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
gcc/tree-data-ref.c:2454:16: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
gcc/tree-ssa-loop-ivopts.c:4186:24: runtime error: signed integer overflow: 4 * 4611686018427387903 cannot be represented in type 'long int'
libiberty/cp-demangle.c:4074:40: runtime error: variable length array bound evaluates to non-positive value 0
libiberty/cp-demangle.c:4075:43: runtime error: variable length array bound evaluates to non-positive value 0
libiberty/regex.c:6970:11: runtime error: left shift of negative value -1
libiberty/regex.c:7165:4: runtime error: left shift of negative value -1
Comment 4 Markus Trippelsdorf 2015-03-03 09:16:53 UTC
Here's the list of issues found today on ppc64le:

gcc/c/c-typeck.c:8239:42: runtime error: load of address 0x3fffefac3e10 with insufficient space for an object of type 'long int'
gcc/c/c-typeck.c:8239:42: runtime error: store to address 0x3fffd838e360 with insufficient space for an object of type 'long int'
gcc/c-family/c-ada-spec.c:105:22: runtime error: load of address 0x3fffd57d3a88 with insufficient space for an object of type 'int'
gcc/c-family/c-ada-spec.c:93:34: runtime error: load of address 0x3fffd57d3a88 with insufficient space for an object of type 'int'
gcc/c-family/c-ada-spec.c:97:23: runtime error: load of address 0x3fffd57d3a88 with insufficient space for an object of type 'int'
gcc/expmed.c:3024:42: runtime error: signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long int'
gcc/fortran/data.c:181:32: runtime error: null pointer passed as argument 2, which is declared to never be null
gcc/fortran/interface.c:2701:33: runtime error: load of value 1818451807, which is not a valid value for type 'expr_t'
gcc/fortran/interface.c:2949:42: runtime error: load of value 272321136, which is not a valid value for type 'ar_type'
gcc/fortran/module.c:2361:28: runtime error: load of value 271605604, which is not a valid value for type 'bt'
gcc/fortran/trans-array.c:2223:27: runtime error: load of value 100, which is not a valid value for type 'bool'
gcc/fortran/trans-array.c:2223:27: runtime error: load of value 100, which is not a valid value for type 'bool'
gcc/fortran/trans-expr.c:2384:48: runtime error: negation of -9223372036854775808 cannot be represented in type 'long int [3]'; cast to an unsigned type to negate this value to itself
gcc/fortran/trans-expr.c:5454:19: runtime error: member call on null pointer of type 'struct vec'
gcc/fortran/trans-expr.c:5457:19: runtime error: member call on null pointer of type 'struct vec'
gcc/fortran/trans-expr.c:5460:19: runtime error: member call on null pointer of type 'struct vec'
gcc/gcov-io.c:376:38: runtime error: null pointer passed as argument 2, which is declared to never be null
gcc/hwint.h:250:19: runtime error: shift exponent 64 is too large for 64-bit type 'long int'
gcc/ipa-prop.c:2489:30: runtime error: member call on null pointer of type 'struct ipa_polymorphic_call_context'
gcc/loop-iv.c:2670:25: runtime error: signed integer overflow: 100 - -9223372036854775808 cannot be represented in type 'long int'
gcc/simplify-rtx.c:5189:10: runtime error: shift exponent -56 is negative
gcc/tree-data-ref.c:2411:38: runtime error: signed integer overflow: 1073741824 + 1073741824 cannot be represented in type 'int'
gcc/tree-data-ref.c:2500:16: runtime error: signed integer overflow: 131072 * -131072 cannot be represented in type 'int'
gcc/tree-data-ref.c:2501:16: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
gcc/tree-data-ref.c:2502:16: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
libiberty/cp-demangle.c:4074:40: runtime error: variable length array bound evaluates to non-positive value 0
libiberty/cp-demangle.c:4075:43: runtime error: variable length array bound evaluates to non-positive value 0
Comment 5 Jakub Jelinek 2015-04-22 11:59:35 UTC
GCC 5.1 has been released.
Comment 6 Richard Biener 2015-07-16 09:12:04 UTC
GCC 5.2 is being released, adjusting target milestone to 5.3.
Comment 7 Richard Biener 2015-12-04 10:44:28 UTC
GCC 5.3 is being released, adjusting target milestone.
Comment 8 Richard Biener 2016-06-03 10:04:51 UTC
GCC 5.4 is being released, adjusting target milestone.
Comment 9 postmaster 2019-10-22 08:26:52 UTC Comment hidden (spam)
Comment 10 postmaster 2019-10-22 08:26:53 UTC Comment hidden (spam)
Comment 11 postmaster 2019-10-22 18:43:03 UTC Comment hidden (spam)
Comment 12 postmaster 2019-10-22 18:43:04 UTC Comment hidden (spam)
Comment 13 postmaster 2019-10-24 08:54:06 UTC Comment hidden (spam)
Comment 14 postmaster 2019-10-24 08:54:07 UTC Comment hidden (obsolete)
Comment 15 postmaster 2019-10-24 11:06:52 UTC Comment hidden (spam)
Comment 16 postmaster 2019-10-24 11:06:55 UTC Comment hidden (obsolete)