Bug 95667 - [11 Regression] unintended warning for memset writing across multiple members
Summary: [11 Regression] unintended warning for memset writing across multiple members
Alias: None
Product: gcc
Classification: Unclassified
Component: middle-end (show other bugs)
Version: 11.0
: P3 normal
Target Milestone: 11.0
Assignee: Martin Sebor
Keywords: diagnostic, patch
Depends on:
Blocks: Wstringop-overflow
  Show dependency treegraph
Reported: 2020-06-13 23:36 UTC by Martin Sebor
Modified: 2020-08-20 16:37 UTC (History)
0 users

See Also:
Known to work:
Known to fail:
Last reconfirmed: 2020-06-13 00:00:00


Note You need to log in before you can comment on or make changes to this bug.
Description Martin Sebor 2020-06-13 23:36:37 UTC
Although strictly correct, GCC usually avoids warning for calls to memcpy that write into multiple members at the same time, up to the size of the complete object.  This is done because the Linux kernel does these things in a few places.  As dangerous as the practice is, the change committed to resolve pr95353 (r11-1183) tried to preserve this behavior for now (in the future I'd like to add a new warning option to control it), but the test case below shows it didn't preserve the GCC 10 and prior behavior in this case (same with memcpy).

$ cat z.c && gcc -O2 -S -Wall -Wextra -fdump-tree-optimized=/dev/stdout z.c
struct S { char a[3], b[5]; };

void* f (void)
  struct S *p = __builtin_malloc (sizeof *p);
  char s[] = "1234567";
  __builtin_strcpy (p->a, s);          // warning (good)
  return p;

void* g (void)
  struct S *p = __builtin_malloc (sizeof *p);
  __builtin_memset (p->a, 0, 8);       // warning not expected (yet)
  return p;
z.c: In function ‘f’:
z.c:7:3: warning: ‘__builtin_strcpy’ writing 8 bytes into a region of size 3 [-Wstringop-overflow=]
    7 |   __builtin_strcpy (p->a, s);          // warning (good)
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~
z.c:1:17: note: at offset 0 to object ‘a’ with size 3 declared here
    1 | struct S { char a[3], b[5]; };
      |                 ^

;; Function f (f, funcdef_no=0, decl_uid=1934, cgraph_uid=1, symbol_order=0)

f ()
  char s[8];
  struct S * p;
  long unsigned int _8;

  <bb 2> [local count: 1073741824]:
  p_4 = __builtin_malloc (8);
  s = "1234567";
  _8 = MEM <long unsigned int> [(char * {ref-all})&s];
  MEM <long unsigned int> [(char * {ref-all})p_4] = _8;
  s ={v} {CLOBBER};
  return p_4;


;; Function g (g, funcdef_no=1, decl_uid=1939, cgraph_uid=2, symbol_order=1)

g ()
  struct S * p;
  char[3] * _1;

  <bb 2> [local count: 1073741824]:
  p_4 = __builtin_malloc (8);
  _1 = &p_4->a;
  __builtin_memset (_1, 0, 8);
  return p_4;


z.c: In function ‘g’:
z.c:14:3: warning: ‘__builtin_memset’ writing 8 bytes into a region of size 3 overflows the destination [-Wstringop-overflow=]
   14 |   __builtin_memset (p->a, 0, 8);       // warning not expected (yet)
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
z.c:1:17: note: destination object ‘a’
    1 | struct S { char a[3], b[5]; };
      |                 ^
Comment 1 Martin Sebor 2020-06-13 23:38:39 UTC
See https://gcc.gnu.org/pipermail/gcc-patches/2020-June/548040.html for the original report.
Comment 3 GCC Commits 2020-06-18 18:02:07 UTC
The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:


commit r11-1517-g5acc654e380797bbf402bc3a0a67f9a6ac4c2a83
Author: Martin Sebor <msebor@redhat.com>
Date:   Thu Jun 18 12:00:36 2020 -0600

    Avoid warning for memset writing over multiple members.
    PR middle-end/95667 - unintended warning for memset writing across multiple members
    PR middle-end/92814 - missing -Wstringop-overflow writing into a dynamically allocated flexible array member
            PR middle-end/95667
            PR middle-end/92814
            * builtins.c (compute_objsize): Remove call to
            compute_builtin_object_size and instead compute conservative sizes
            directly here.
            PR middle-end/95667
            PR middle-end/92814
            * gcc.dg/Wstringop-overflow-25.c: Remove xfails.
            * gcc.dg/Wstringop-overflow-39.c: New test.
Comment 4 Martin Sebor 2020-08-20 16:37:48 UTC
Fixed in r11-1517.