Bug 95795 - missing warning on strnlen with a nonstring and excessive bound
Summary: missing warning on strnlen with a nonstring and excessive bound
Status: UNCONFIRMED
Alias: None
Product: gcc
Classification: Unclassified
Component: middle-end (show other bugs)
Version: 10.0
: P3 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords: diagnostic
Depends on:
Blocks: Wstringop-overflow
  Show dependency treegraph
 
Reported: 2020-06-20 23:39 UTC by Martin Sebor
Modified: 2020-06-20 23:39 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Sebor 2020-06-20 23:39:42 UTC
GCC warns for the first call to strnlen in f() that may read past the end of the unterminated array but it fails to warn for the second equally unsafe call in g().

$ cat z.c && gcc -O2 -S -fdump-tree-optimized=/dev/stdout z.c
__attribute__ ((nonstring)) char a[3];

int f (void)
{
  return __builtin_strnlen (a, 7);
}

int g (int i)
{
  return __builtin_strnlen (a + i, 7);
}

;; Function f (f, funcdef_no=0, decl_uid=1931, cgraph_uid=1, symbol_order=1)

f ()
{
  long unsigned int _1;
  int _3;

  <bb 2> [local count: 1073741824]:
  _1 = __builtin_strnlen (&a, 7);
  _3 = (int) _1;
  return _3;

}


z.c: In function ‘f’:
z.c:5:10: warning: ‘__builtin_strnlen’ argument 1 declared attribute ‘nonstring’ is smaller than the specified bound 7 [-Wstringop-overflow=]
    5 |   return __builtin_strnlen (a, 7);
      |          ^~~~~~~~~~~~~~~~~~~~~~~~
z.c:1:34: note: argument ‘a’ declared here
    1 | __attribute__ ((nonstring)) char a[3];
      |                                  ^

;; Function g (g, funcdef_no=1, decl_uid=1934, cgraph_uid=2, symbol_order=2)

g (int i)
{
  sizetype _1;
  const char * _2;
  long unsigned int _3;
  int _6;

  <bb 2> [local count: 1073741824]:
  _1 = (sizetype) i_4(D);
  _2 = &a + _1;
  _3 = __builtin_strnlen (_2, 7);
  _6 = (int) _3;
  return _6;

}