[Bug middle-end/101397] New: spurious warning writing to the result of stpcpy minus 1
msebor at gcc dot gnu.org
gcc-bugzilla@gcc.gnu.org
Fri Jul 9 18:23:08 GMT 2021
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101397
Bug ID: 101397
Summary: spurious warning writing to the result of stpcpy minus
1
Product: gcc
Version: 11.1.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: middle-end
Assignee: unassigned at gcc dot gnu.org
Reporter: msebor at gcc dot gnu.org
Target Milestone: ---
This is reduced from a recent Glibc build with GCC 12 which shows the warning
below:
In function ‘nis_local_group’,
inlined from ‘nis_local_group’ at nis_local_names.c:27:1:
nis_local_names.c:38:13: error: array subscript -1 is outside array bounds of
‘char[1025]’ [-Werror=array-bounds]
38 | if (cp[-1] != '.')
| ~~^~~~
nis_local_names.c: In function ‘nis_local_group’:
nis_local_names.c:29:15: note: at offset -1 into object ‘__nisgroup’ of size
1025
29 | static char __nisgroup[NIS_MAXNAMELEN + 1];
| ^~~~~~~~~~
The following test case shows the warning is a false positive. Since stpcpy()
returns a pointer to the terminating null it appends to the destination neither
of the warnings below is appropriate since there's no indication that the
copied string is empty. The output below is with GCC 11.1. In GCC 12 the
second -Wstringop-overflow becomes a -Warray-bounds.
$ cat t.c && gcc -O2 -S -Wall t.c
void f (void*);
void g (const char *s)
{
char d[8];
char *t = __builtin_stpcpy (d, s);
__builtin_strcpy (t - 1, "x");
f (d);
}
void h (const char *s)
{
char d[8];
char *t = __builtin_stpcpy (d, s);
t[-1] = 0;
f (d);
}
t.c: In function ‘g’:
t.c:7:3: warning: ‘__builtin_memcpy’ writing 2 bytes into a region of size 0
overflows the destination [-Wstringop-overflow=]
7 | __builtin_strcpy (t - 1, "x");
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
t.c:5:8: note: at offset -1 into destination object ‘d’ of size 8
5 | char d[8];
| ^
t.c: In function ‘h’:
t.c:15:9: warning: writing 1 byte into a region of size 0
[-Wstringop-overflow=]
15 | t[-1] = 0;
| ~~~~~~^~~
t.c:13:8: note: at offset -1 into destination object ‘d’ of size 8
13 | char d[8];
| ^
More information about the Gcc-bugs
mailing list