[Bug c/48985] bogus buffer overflow warning and abort on static flexible array member

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48985

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2011.05.13 09:27:38
         AssignedTo|unassigned at gcc dot       |rguenth at gcc dot gnu.org
                   |gnu.org                     |
     Ever Confirmed|0                           |1
      Known to fail|                            |4.3.0, 4.6.1, 4.7.0

--- Comment #1 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-05-13 09:27:38 UTC ---
The issue is that the type of the static declaration is never adjusted and
we take the total size from the type instead of from the decl.

Instead doing sth like

Index: gcc/tree-object-size.c
===================================================================
--- gcc/tree-object-size.c      (revision 173724)
+++ gcc/tree-object-size.c      (working copy)
@@ -205,6 +205,12 @@ addr_object_size (struct object_size_inf
        pt_var_size = size_int (sz);
     }
   else if (pt_var
+          && DECL_P (pt_var)
+          && host_integerp (DECL_SIZE_UNIT (pt_var), 1)
+          && (unsigned HOST_WIDE_INT)
+               tree_low_cst (DECL_SIZE_UNIT (pt_var), 1) < offset_limit)
+    pt_var_size = DECL_SIZE_UNIT (pt_var);
+  else if (pt_var
           && (SSA_VAR_P (pt_var) || TREE_CODE (pt_var) == STRING_CST)
           && TYPE_SIZE_UNIT (TREE_TYPE (pt_var))
           && host_integerp (TYPE_SIZE_UNIT (TREE_TYPE (pt_var)), 1)

fixes it for me (returns 6).

I suppose returning zero for a field that has incomplete type is wrong-code.
We should return -1 instead.