Due to an overflow in size calculation the following (seemingly reasonable) program compiles fine, allocates too small array and crashes in a loop: #include <stdint.h> #include <stdlib.h> #include <stdio.h> #define N (SIZE_MAX / sizeof(int) + 2) int main(void) { int (*p)[N]; printf("%zu\n", sizeof *p); p = malloc(sizeof *p); if (!p) return 1; for (size_t i = 0; i < N; i++) (*p)[i] = 1; return 0; } According to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68065#c4 : "Any construction of a non-VLA type whose size is half or more of the address space should receive a compile-time error, like you get if you don't use a pointer here."
grokdeclarator seems to check the declared size of an array (when processing an array declarator) - that is, the size counted in array elements - and then has a separate check for the size in bytes only when the final type of the full declarator is an array type. I think the check on the size in bytes needs moving up to check every non-VLA complete array type constructed in the course of processing the declarator.
The same seems to apply for the C++ FE as well.
Author: mpolacek Date: Wed Nov 11 14:47:03 2015 New Revision: 230174 URL: https://gcc.gnu.org/viewcvs?rev=230174&root=gcc&view=rev Log: PR c/68107 PR c++/68266 * c-common.c (valid_array_size_p): New function. * c-common.h (valid_array_size_p): Declare. * c-decl.c (grokdeclarator): Call valid_array_size_p. Remove code checking the size of an array. * decl.c (grokdeclarator): Call valid_array_size_p. Remove code checking the size of an array. * c-c++-common/pr68107.c: New test. * g++.dg/init/new38.C (large_array_char): Adjust dg-error. (large_array_char_template): Likewise. * g++.dg/init/new44.C: Adjust dg-error. Added: trunk/gcc/testsuite/c-c++-common/pr68107.c Modified: trunk/gcc/c-family/ChangeLog trunk/gcc/c-family/c-common.c trunk/gcc/c-family/c-common.h trunk/gcc/c/ChangeLog trunk/gcc/c/c-decl.c trunk/gcc/cp/ChangeLog trunk/gcc/cp/decl.c trunk/gcc/testsuite/ChangeLog trunk/gcc/testsuite/g++.dg/init/new38.C trunk/gcc/testsuite/g++.dg/init/new44.C
Should be fixed.