[PATCH] waccess: Fix up pass_waccess::check_alloc_size_call [PR102009]

[Richard Biener]

On Tue, 16 Nov 2021, Jakub Jelinek wrote:

> Hi!
> 
> This function punts if the builtins have no arguments, but as can be seen
> on the testcase, even if it has some arguments but alloc_size attribute's
> arguments point to arguments that aren't passed, we get a warning earlier
> from the FE but should punt rather than ICE on it.
> Other users of alloc_size attribute e.g. in
> tree-object-size.c (alloc_object_size) punt similarly and similarly
> even in the same TU maybe_warn_nonstring_arg correctly verifies calls have
> enough arguments.
> 
> Bootstrapped/regtested on x86_64-linux and i686-linux, ok for trunk?

OK.

Thanks,
Richard.

> 2021-11-16  Jakub Jelinek  <jakub@redhat.com>
> 
> 	PR tree-optimization/102009
> 	* gimple-ssa-warn-access.cc (pass_waccess::check_alloc_size_call):
> 	Punt if any of alloc_size arguments is out of bounds vs. number of
> 	call arguments.
> 
> 	* gcc.dg/pr102009.c: New test.
> 
> --- gcc/gimple-ssa-warn-access.cc.jj	2021-11-09 15:25:15.000000000 +0100
> +++ gcc/gimple-ssa-warn-access.cc	2021-11-15 17:22:44.769580185 +0100
> @@ -2335,10 +2335,6 @@ pass_waccess::check_alloca (gcall *stmt)
>  void
>  pass_waccess::check_alloc_size_call (gcall *stmt)
>  {
> -  if (gimple_call_num_args (stmt) < 1)
> -    /* Avoid invalid calls to functions without a prototype.  */
> -    return;
> -
>    tree fndecl = gimple_call_fndecl (stmt);
>    if (fndecl && gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
>      {
> @@ -2367,13 +2363,19 @@ pass_waccess::check_alloc_size_call (gca
>       the actual argument(s) at those indices in ALLOC_ARGS.  */
>    int idx[2] = { -1, -1 };
>    tree alloc_args[] = { NULL_TREE, NULL_TREE };
> +  unsigned nargs = gimple_call_num_args (stmt);
>  
>    tree args = TREE_VALUE (alloc_size);
>    idx[0] = TREE_INT_CST_LOW (TREE_VALUE (args)) - 1;
> +  /* Avoid invalid calls to functions without a prototype.  */
> +  if ((unsigned) idx[0] >= nargs)
> +    return;
>    alloc_args[0] = call_arg (stmt, idx[0]);
>    if (TREE_CHAIN (args))
>      {
>        idx[1] = TREE_INT_CST_LOW (TREE_VALUE (TREE_CHAIN (args))) - 1;
> +      if ((unsigned) idx[1] >= nargs)
> +	return;
>        alloc_args[1] = call_arg (stmt, idx[1]);
>      }
>  
> --- gcc/testsuite/gcc.dg/pr102009.c.jj	2021-11-15 17:29:19.090162531 +0100
> +++ gcc/testsuite/gcc.dg/pr102009.c	2021-11-15 17:30:08.328486037 +0100
> @@ -0,0 +1,10 @@
> +/* PR tree-optimization/102009 */
> +/* { dg-do compile } */
> +
> +void *realloc ();	/* { dg-message "declared here" } */
> +
> +void *
> +foo (void *p)
> +{
> +  return realloc (p);	/* { dg-warning "too few arguments to built-in function 'realloc' expecting " } */
> +}
> 
> 	Jakub
> 
> 

-- 
Richard Biener <rguenther@suse.de>
SUSE Software Solutions Germany GmbH, Maxfeldstrasse 5, 90409 Nuernberg,
Germany; GF: Ivo Totev; HRB 36809 (AG Nuernberg)