Missed warning (-Wuse-after-free)

[Alejandro Colomar]

Hi!

I was preparing an example program of a use-after-realloc bug,
when I found that GCC doesn't warn in a case where it should.


alx@debian:~/tmp$ cat realloc.c
#include <stdint.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

static inline char *
xstrdup(const char *s)
{
	char  *p;

	p = strdup(s);
	if (p == NULL)
		exit(EXIT_FAILURE);
	return p;
}

static inline char *
strnul(const char *s)
{
	return (char *) s + strlen(s);
}

int
main(void)
{
	char  *p, *q;

	p = xstrdup("");
	q = strnul(p);

	if (p == q)
		puts("equal before");
	else
		exit(EXIT_FAILURE); // It's an empty string; this won't happen

	printf("p = %p; q = %p\n", p, q);

	p = realloc(p, UINT16_MAX);
	if (p == NULL)
		exit(EXIT_FAILURE);
	puts("realloc()");

	if (p == q) {  // Use after realloc.  I'd expect a warning here.
		puts("equal after");
	} else {
		/* Can we get here?
		   Let's see the options:

			- realloc(3) fails:
				We exit immediately.  We don't arrive here.

			- realloc(3) doesn't move the memory:
				p == q, as before

			- realloc(3) moved the memory:
				p is guaranteed to be a unique pointer,
				and q is now an invalid pointer.  It is
				Undefined Behavior to read `q`, so `p == q`
				is UB.

		   As we see, there's no _defined_ path where this can happen
		 */
		printf("PID = %i\n", (int) getpid());
	}

	printf("p = %p; q = %p\n", p, q);
}
alx@debian:~/tmp$ cc -Wall -Wextra realloc.c -O3 -fanalyzer
realloc.c: In function ‘main’:
realloc.c:67:9: warning: pointer ‘p’ may be used after ‘realloc’ [-Wuse-after-free]
   67 |         printf("p = %p; q = %p\n", p, q);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
realloc.c:39:13: note: call to ‘realloc’ here
   39 |         p = realloc(p, UINT16_MAX);
      |             ^~~~~~~~~~~~~~~~~~~~~~
alx@debian:~/tmp$ ./a.out 
equal before
p = 0x55bff80802a0; q = 0x55bff80802a0
realloc()
PID = 25222
p = 0x55bff80806d0; q = 0x55bff80802a0


Did I miss anything?

Cheers,

Alex

-- 
<http://www.alejandro-colomar.es/>
GPG key fingerprint: A9348594CE31283A826FBDD8D57633D441E25BB5
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://gcc.gnu.org/pipermail/gcc/attachments/20230216/b653db1c/attachment.sig>