1 /* Pass to detect and issue warnings for violations of the restrict
3 Copyright (C) 2017-2018 Free Software Foundation, Inc.
4 Contributed by Martin Sebor <msebor@redhat.com>.
6 This file is part of GCC.
8 GCC is free software; you can redistribute it and/or modify it under
9 the terms of the GNU General Public License as published by the Free
10 Software Foundation; either version 3, or (at your option) any later
13 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
14 WARRANTY; without even the implied warranty of MERCHANTABILITY or
15 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
18 You should have received a copy of the GNU General Public License
19 along with GCC; see the file COPYING3. If not see
20 <http://www.gnu.org/licenses/>. */
24 #include "coretypes.h"
29 #include "tree-pass.h"
32 #include "gimple-pretty-print.h"
33 #include "gimple-ssa-warn-restrict.h"
34 #include "diagnostic-core.h"
35 #include "fold-const.h"
36 #include "gimple-iterator.h"
41 #include "tree-object-size.h"
48 const pass_data pass_data_wrestrict
= {
53 PROP_cfg
, /* Properties_required. */
54 0, /* properties_provided. */
55 0, /* properties_destroyed. */
56 0, /* properties_start */
57 0, /* properties_finish */
60 /* Pass to detect violations of strict aliasing requirements in calls
61 to built-in string and raw memory functions. */
62 class pass_wrestrict
: public gimple_opt_pass
65 pass_wrestrict (gcc::context
*ctxt
)
66 : gimple_opt_pass (pass_data_wrestrict
, ctxt
)
69 opt_pass
*clone () { return new pass_wrestrict (m_ctxt
); }
71 virtual bool gate (function
*);
72 virtual unsigned int execute (function
*);
76 pass_wrestrict::gate (function
*fun ATTRIBUTE_UNUSED
)
78 return warn_array_bounds
!= 0 || warn_restrict
!= 0;
81 /* Class to walk the basic blocks of a function in dominator order. */
82 class wrestrict_dom_walker
: public dom_walker
85 wrestrict_dom_walker () : dom_walker (CDI_DOMINATORS
) {}
87 edge
before_dom_children (basic_block
) FINAL OVERRIDE
;
88 bool handle_gimple_call (gimple_stmt_iterator
*);
91 void check_call (gcall
*);
95 wrestrict_dom_walker::before_dom_children (basic_block bb
)
97 /* Iterate over statements, looking for function calls. */
98 for (gimple_stmt_iterator si
= gsi_start_bb (bb
); !gsi_end_p (si
);
101 gimple
*stmt
= gsi_stmt (si
);
102 if (!is_gimple_call (stmt
))
105 if (gcall
*call
= as_a
<gcall
*> (stmt
))
112 /* Execute the pass for function FUN, walking in dominator order. */
115 pass_wrestrict::execute (function
*fun
)
117 calculate_dominance_info (CDI_DOMINATORS
);
119 wrestrict_dom_walker walker
;
120 walker
.walk (ENTRY_BLOCK_PTR_FOR_FN (fun
));
125 /* Description of a memory reference by a built-in function. This
126 is similar to ao_ref but made especially suitable for -Wrestrict
127 and not for optimization. */
128 struct builtin_memref
130 /* The original pointer argument to the built-in function. */
132 /* The referenced subobject or NULL if not available, and the base
133 object of the memory reference or NULL. */
137 /* The size of the BASE object, PTRDIFF_MAX if indeterminate,
138 and negative until (possibly lazily) initialized. */
141 /* The non-negative offset of the referenced subobject. Used to avoid
142 warnings for (apparently) possibly but not definitively overlapping
143 accesses to member arrays. Negative when unknown/invalid. */
146 /* The offset range relative to the base. */
147 offset_int offrange
[2];
148 /* The size range of the access to this reference. */
149 offset_int sizrange
[2];
151 /* True for "bounded" string functions like strncat, and strncpy
152 and their variants that specify either an exact or upper bound
153 on the size of the accesses they perform. For strncat both
154 the source and destination references are bounded. For strncpy
155 only the destination reference is. */
158 builtin_memref (tree
, tree
);
160 tree
offset_out_of_bounds (int, offset_int
[2]) const;
163 /* Description of a memory access by a raw memory or string built-in
164 function involving a pair of builtin_memref's. */
168 /* Destination and source memory reference. */
169 builtin_memref
* const dstref
;
170 builtin_memref
* const srcref
;
171 /* The size range of the access. It's the greater of the accesses
172 to the two references. */
173 HOST_WIDE_INT sizrange
[2];
175 /* The minimum and maximum offset of an overlap of the access
176 (if it does, in fact, overlap), and the size of the overlap. */
177 HOST_WIDE_INT ovloff
[2];
178 HOST_WIDE_INT ovlsiz
[2];
180 /* True to consider valid only accesses to the smallest subobject
181 and false for raw memory functions. */
184 return detect_overlap
!= &builtin_access::generic_overlap
;
187 builtin_access (gcall
*, builtin_memref
&, builtin_memref
&);
189 /* Entry point to determine overlap. */
193 /* Implementation functions used to determine overlap. */
194 bool generic_overlap ();
195 bool strcat_overlap ();
196 bool strcpy_overlap ();
203 offset_int
overlap_size (const offset_int
[2], const offset_int
[2],
207 /* Temporaries used to compute the final result. */
208 offset_int dstoff
[2];
209 offset_int srcoff
[2];
210 offset_int dstsiz
[2];
211 offset_int srcsiz
[2];
213 /* Pointer to a member function to call to determine overlap. */
214 bool (builtin_access::*detect_overlap
) ();
217 /* Initialize a memory reference representation from a pointer EXPR and
218 a size SIZE in bytes. If SIZE is NULL_TREE then the size is assumed
221 builtin_memref::builtin_memref (tree expr
, tree size
)
226 refoff (HOST_WIDE_INT_MIN
),
231 /* Unfortunately, wide_int default ctor is a no-op so array members
232 of the type must be set individually. */
233 offrange
[0] = offrange
[1] = 0;
234 sizrange
[0] = sizrange
[1] = 0;
236 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
238 if (TREE_CODE (expr
) == SSA_NAME
)
240 /* Try to tease the offset out of the pointer. */
241 gimple
*stmt
= SSA_NAME_DEF_STMT (expr
);
242 if (gimple_assign_single_p (stmt
)
243 && gimple_assign_rhs_code (stmt
) == ADDR_EXPR
)
244 expr
= gimple_assign_rhs1 (stmt
);
245 else if (is_gimple_assign (stmt
))
247 tree_code code
= gimple_assign_rhs_code (stmt
);
248 if (code
== NOP_EXPR
)
250 tree rhs
= gimple_assign_rhs1 (stmt
);
251 if (POINTER_TYPE_P (TREE_TYPE (rhs
)))
252 expr
= gimple_assign_rhs1 (stmt
);
254 else if (code
== POINTER_PLUS_EXPR
)
256 expr
= gimple_assign_rhs1 (stmt
);
258 tree offset
= gimple_assign_rhs2 (stmt
);
259 if (TREE_CODE (offset
) == INTEGER_CST
)
261 offset_int off
= int_cst_value (offset
);
265 if (TREE_CODE (expr
) == SSA_NAME
)
267 gimple
*stmt
= SSA_NAME_DEF_STMT (expr
);
268 if (gimple_assign_single_p (stmt
)
269 && gimple_assign_rhs_code (stmt
) == ADDR_EXPR
)
270 expr
= gimple_assign_rhs1 (stmt
);
273 else if (TREE_CODE (offset
) == SSA_NAME
)
276 value_range_type rng
= get_range_info (offset
, &min
, &max
);
279 offrange
[0] = offset_int::from (min
, SIGNED
);
280 offrange
[1] = offset_int::from (max
, SIGNED
);
282 else if (rng
== VR_ANTI_RANGE
)
284 offrange
[0] = offset_int::from (max
+ 1, SIGNED
);
285 offrange
[1] = offset_int::from (min
- 1, SIGNED
);
289 gimple
*stmt
= SSA_NAME_DEF_STMT (offset
);
291 if (is_gimple_assign (stmt
)
292 && gimple_assign_rhs_code (stmt
) == NOP_EXPR
293 && (type
= TREE_TYPE (gimple_assign_rhs1 (stmt
)))
294 && INTEGRAL_TYPE_P (type
))
296 /* Use the bounds of the type of the NOP_EXPR operand
297 even if it's signed. The result doesn't trigger
298 warnings but makes their output more readable. */
299 offrange
[0] = wi::to_offset (TYPE_MIN_VALUE (type
));
300 offrange
[1] = wi::to_offset (TYPE_MAX_VALUE (type
));
303 offrange
[1] = maxobjsize
;
307 offrange
[1] = maxobjsize
;
312 if (TREE_CODE (expr
) == ADDR_EXPR
)
315 tree op
= TREE_OPERAND (expr
, 0);
317 /* Determine the base object or pointer of the reference
318 and its constant offset from the beginning of the base. */
319 base
= get_addr_base_and_unit_offset (op
, &off
);
321 HOST_WIDE_INT const_off
;
322 if (base
&& off
.is_constant (&const_off
))
324 offrange
[0] += const_off
;
325 offrange
[1] += const_off
;
327 /* Stash the reference for offset validation. */
330 /* Also stash the constant offset for offset validation. */
331 if (TREE_CODE (op
) == COMPONENT_REF
)
337 base
= get_base_address (TREE_OPERAND (expr
, 0));
342 base
= build2 (MEM_REF
, char_type_node
, expr
, null_pointer_node
);
344 if (TREE_CODE (base
) == MEM_REF
)
347 if (mem_ref_offset (base
).is_constant (&off
))
355 base
= TREE_OPERAND (base
, 0);
358 if (TREE_CODE (base
) == SSA_NAME
)
359 if (gimple
*stmt
= SSA_NAME_DEF_STMT (base
))
361 enum gimple_code code
= gimple_code (stmt
);
362 if (code
== GIMPLE_ASSIGN
)
363 if (gimple_assign_rhs_code (stmt
) == POINTER_PLUS_EXPR
)
365 base
= gimple_assign_rhs1 (stmt
);
367 tree offset
= gimple_assign_rhs2 (stmt
);
368 if (TREE_CODE (offset
) == INTEGER_CST
)
370 offset_int off
= int_cst_value (offset
);
377 if (TREE_CODE (base
) == SSA_NAME
&& SSA_NAME_VAR (base
))
378 base
= SSA_NAME_VAR (base
);
384 /* Determine the size range, allowing for the result to be [0, 0]
385 for SIZE in the anti-range ~[0, N] where N >= PTRDIFF_MAX. */
386 get_size_range (size
, range
, true);
387 sizrange
[0] = wi::to_offset (range
[0]);
388 sizrange
[1] = wi::to_offset (range
[1]);
389 /* get_size_range returns SIZE_MAX for the maximum size.
390 Constrain it to the real maximum of PTRDIFF_MAX. */
391 if (sizrange
[1] > maxobjsize
)
392 sizrange
[1] = maxobjsize
;
395 sizrange
[1] = maxobjsize
;
398 /* Return error_mark_node if the signed offset exceeds the bounds
399 of the address space (PTRDIFF_MAX). Otherwise, return either
400 BASE or REF when the offset exceeds the bounds of the BASE or
401 REF object, and set OOBOFF to the past-the-end offset formed
402 by the reference, including its size. When STRICT is non-zero
403 use REF size, when available, otherwise use BASE size. When
404 STRICT is greater than 1, use the size of the last array member
405 as the bound, otherwise treat such a member as a flexible array
406 member. Return NULL when the offset is in bounds. */
409 builtin_memref::offset_out_of_bounds (int strict
, offset_int ooboff
[2]) const
411 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
413 /* A temporary, possibly adjusted, copy of the offset range. */
414 offset_int offrng
[2] = { offrange
[0], offrange
[1] };
416 if (DECL_P (base
) && TREE_CODE (TREE_TYPE (base
)) == ARRAY_TYPE
)
418 /* Check for offset in an anti-range with a negative lower bound.
419 For such a range, consider only the non-negative subrange. */
420 if (offrng
[1] < offrng
[0] && offrng
[1] < 0)
421 offrng
[1] = maxobjsize
;
424 /* Conservative offset of the last byte of the referenced object. */
427 /* The bounds need not be ordered. Set HIB to use as the index
428 of the larger of the bounds and LOB as the opposite. */
429 bool hib
= wi::les_p (offrng
[0], offrng
[1]);
434 endoff
= offrng
[lob
] + sizrange
[0];
436 /* For a reference through a pointer to an object of unknown size
437 all initial offsets are considered valid, positive as well as
438 negative, since the pointer itself can point past the beginning
439 of the object. However, the sum of the lower bound of the offset
440 and that of the size must be less than or equal than PTRDIFF_MAX. */
441 if (endoff
> maxobjsize
)
442 return error_mark_node
;
447 /* A reference to an object of known size must be within the bounds
448 of the base object. */
449 if (offrng
[hib
] < 0 || offrng
[lob
] > basesize
)
452 /* The extent of the reference must also be within the bounds of
453 the base object (if known) or the maximum object size otherwise. */
454 endoff
= wi::smax (offrng
[lob
], 0) + sizrange
[0];
455 if (endoff
> maxobjsize
)
456 return error_mark_node
;
458 offset_int size
= basesize
;
465 && TREE_CODE (ref
) == COMPONENT_REF
467 || !array_at_struct_end_p (ref
)))
469 /* If the reference is to a member subobject, the offset must
470 be within the bounds of the subobject. */
471 tree field
= TREE_OPERAND (ref
, 1);
472 tree type
= TREE_TYPE (field
);
473 if (tree sz
= TYPE_SIZE_UNIT (type
))
474 if (TREE_CODE (sz
) == INTEGER_CST
)
476 size
= refoff
+ wi::to_offset (sz
);
484 /* Set the out-of-bounds offset range to be one greater than
485 that delimited by the reference including its size. */
486 ooboff
[lob
] = size
+ 1;
488 if (endoff
> ooboff
[lob
])
489 ooboff
[hib
] = endoff
;
491 ooboff
[hib
] = wi::smax (offrng
[lob
], 0) + sizrange
[1];
496 /* Create an association between the memory references DST and SRC
497 for access by a call EXPR to a memory or string built-in funtion. */
499 builtin_access::builtin_access (gcall
*call
, builtin_memref
&dst
,
501 : dstref (&dst
), srcref (&src
), sizrange (), ovloff (), ovlsiz (),
502 dstoff (), srcoff (), dstsiz (), srcsiz ()
504 /* Zero out since the offset_int ctors invoked above are no-op. */
505 dstoff
[0] = dstoff
[1] = 0;
506 srcoff
[0] = srcoff
[1] = 0;
507 dstsiz
[0] = dstsiz
[1] = 0;
508 srcsiz
[0] = srcsiz
[1] = 0;
510 /* Object Size Type to use to determine the size of the destination
511 and source objects. Overridden below for raw memory functions. */
514 /* True when the size of one reference depends on the offset of
515 itself or the other. */
516 bool depends_p
= true;
518 /* True when the size of the destination reference DSTREF has been
519 determined from SRCREF and so needs to be adjusted by the latter's
520 offset. Only meaningful for bounded string functions like strncpy. */
521 bool dstadjust_p
= false;
523 /* The size argument number (depends on the built-in). */
524 unsigned sizeargno
= 2;
525 if (gimple_call_with_bounds_p (call
))
528 tree func
= gimple_call_fndecl (call
);
529 switch (DECL_FUNCTION_CODE (func
))
531 case BUILT_IN_MEMCPY
:
532 case BUILT_IN_MEMCPY_CHK
:
533 case BUILT_IN_MEMCPY_CHKP
:
534 case BUILT_IN_MEMCPY_CHK_CHKP
:
535 case BUILT_IN_MEMPCPY
:
536 case BUILT_IN_MEMPCPY_CHK
:
537 case BUILT_IN_MEMPCPY_CHKP
:
538 case BUILT_IN_MEMPCPY_CHK_CHKP
:
541 detect_overlap
= &builtin_access::generic_overlap
;
544 case BUILT_IN_MEMMOVE
:
545 case BUILT_IN_MEMMOVE_CHK
:
546 case BUILT_IN_MEMMOVE_CHKP
:
547 case BUILT_IN_MEMMOVE_CHK_CHKP
:
548 /* For memmove there is never any overlap to check for. */
551 detect_overlap
= &builtin_access::no_overlap
;
554 case BUILT_IN_STPNCPY
:
555 case BUILT_IN_STPNCPY_CHK
:
556 case BUILT_IN_STRNCPY
:
557 case BUILT_IN_STRNCPY_CHK
:
558 dstref
->strbounded_p
= true;
559 detect_overlap
= &builtin_access::strcpy_overlap
;
562 case BUILT_IN_STPCPY
:
563 case BUILT_IN_STPCPY_CHK
:
564 case BUILT_IN_STPCPY_CHKP
:
565 case BUILT_IN_STPCPY_CHK_CHKP
:
566 case BUILT_IN_STRCPY
:
567 case BUILT_IN_STRCPY_CHK
:
568 case BUILT_IN_STRCPY_CHKP
:
569 case BUILT_IN_STRCPY_CHK_CHKP
:
570 detect_overlap
= &builtin_access::strcpy_overlap
;
573 case BUILT_IN_STRCAT
:
574 case BUILT_IN_STRCAT_CHK
:
575 case BUILT_IN_STRCAT_CHKP
:
576 case BUILT_IN_STRCAT_CHK_CHKP
:
577 detect_overlap
= &builtin_access::strcat_overlap
;
580 case BUILT_IN_STRNCAT
:
581 case BUILT_IN_STRNCAT_CHK
:
582 dstref
->strbounded_p
= true;
583 srcref
->strbounded_p
= true;
584 detect_overlap
= &builtin_access::strcat_overlap
;
588 /* Handle other string functions here whose access may need
589 to be validated for in-bounds offsets and non-overlapping
590 copies. (Not all _chkp functions have BUILT_IN_XXX_CHKP
591 macros so they need to be handled here.) */
595 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
597 /* Try to determine the size of the base object. compute_objsize
598 expects a pointer so create one if BASE is a non-pointer object. */
600 if (dst
.basesize
< 0)
603 if (!POINTER_TYPE_P (TREE_TYPE (addr
)))
604 addr
= build1 (ADDR_EXPR
, (TREE_TYPE (addr
)), addr
);
606 if (tree dstsize
= compute_objsize (addr
, ostype
))
607 dst
.basesize
= wi::to_offset (dstsize
);
608 else if (POINTER_TYPE_P (TREE_TYPE (addr
)))
609 dst
.basesize
= HOST_WIDE_INT_MIN
;
611 dst
.basesize
= maxobjsize
;
614 if (src
.basesize
< 0)
617 if (!POINTER_TYPE_P (TREE_TYPE (addr
)))
618 addr
= build1 (ADDR_EXPR
, (TREE_TYPE (addr
)), addr
);
620 if (tree srcsize
= compute_objsize (addr
, ostype
))
621 src
.basesize
= wi::to_offset (srcsize
);
622 else if (POINTER_TYPE_P (TREE_TYPE (addr
)))
623 src
.basesize
= HOST_WIDE_INT_MIN
;
625 src
.basesize
= maxobjsize
;
628 /* If there is no dependency between the references or the base
629 objects of the two references aren't the same there's nothing
631 if (depends_p
&& dstref
->base
!= srcref
->base
)
634 /* ...otherwise, make adjustments for references to the same object
635 by string built-in functions to reflect the constraints imposed
638 /* For bounded string functions determine the range of the bound
639 on the access. For others, the range stays unbounded. */
640 offset_int bounds
[2] = { maxobjsize
, maxobjsize
};
641 if (dstref
->strbounded_p
)
643 tree size
= gimple_call_arg (call
, sizeargno
);
645 if (get_size_range (size
, range
, true))
647 bounds
[0] = wi::to_offset (range
[0]);
648 bounds
[1] = wi::to_offset (range
[1]);
651 /* If both references' size ranges are indeterminate use the last
652 (size) argument from the function call as a substitute. This
653 may only be necessary for strncpy (but not for memcpy where
654 the size range would have been already determined this way). */
655 if (dstref
->sizrange
[0] == 0 && dstref
->sizrange
[1] == maxobjsize
656 && srcref
->sizrange
[0] == 0 && srcref
->sizrange
[1] == maxobjsize
)
658 dstref
->sizrange
[0] = bounds
[0];
659 dstref
->sizrange
[1] = bounds
[1];
663 /* The size range of one reference involving the same base object
664 can be determined from the size range of the other reference.
665 This makes it possible to compute accurate offsets for warnings
666 involving functions like strcpy where the length of just one of
667 the two arguments is known (determined by tree-ssa-strlen). */
668 if (dstref
->sizrange
[0] == 0 && dstref
->sizrange
[1] == maxobjsize
)
670 /* When the destination size is unknown set it to the size of
672 dstref
->sizrange
[0] = srcref
->sizrange
[0];
673 dstref
->sizrange
[1] = srcref
->sizrange
[1];
675 else if (srcref
->sizrange
[0] == 0 && srcref
->sizrange
[1] == maxobjsize
)
677 /* When the source size is unknown set it to the size of
679 srcref
->sizrange
[0] = dstref
->sizrange
[0];
680 srcref
->sizrange
[1] = dstref
->sizrange
[1];
684 if (dstref
->strbounded_p
)
686 /* Read access by strncpy is bounded. */
687 if (bounds
[0] < srcref
->sizrange
[0])
688 srcref
->sizrange
[0] = bounds
[0];
689 if (bounds
[1] < srcref
->sizrange
[1])
690 srcref
->sizrange
[1] = bounds
[1];
693 /* For string functions, adjust the size range of the source
694 reference by the inverse boundaries of the offset (because
695 the higher the offset into the string the shorter its
697 if (srcref
->offrange
[1] >= 0
698 && srcref
->offrange
[1] < srcref
->sizrange
[0])
699 srcref
->sizrange
[0] -= srcref
->offrange
[1];
701 srcref
->sizrange
[0] = 0;
703 if (srcref
->offrange
[0] > 0)
705 if (srcref
->offrange
[0] < srcref
->sizrange
[1])
706 srcref
->sizrange
[1] -= srcref
->offrange
[0];
708 srcref
->sizrange
[1] = 0;
715 if (detect_overlap
== &builtin_access::generic_overlap
)
717 if (dstref
->strbounded_p
)
719 dstref
->sizrange
[0] = bounds
[0];
720 dstref
->sizrange
[1] = bounds
[1];
722 if (dstref
->sizrange
[0] < srcref
->sizrange
[0])
723 srcref
->sizrange
[0] = dstref
->sizrange
[0];
725 if (dstref
->sizrange
[1] < srcref
->sizrange
[1])
726 srcref
->sizrange
[1] = dstref
->sizrange
[1];
729 else if (detect_overlap
== &builtin_access::strcpy_overlap
)
731 if (!dstref
->strbounded_p
)
733 /* For strcpy, adjust the destination size range to match that
734 of the source computed above. */
735 if (depends_p
&& dstadjust_p
)
737 dstref
->sizrange
[0] = srcref
->sizrange
[0];
738 dstref
->sizrange
[1] = srcref
->sizrange
[1];
743 if (dstref
->strbounded_p
)
745 /* For strncpy, adjust the destination size range to match that
746 of the source computed above. */
747 dstref
->sizrange
[0] = bounds
[0];
748 dstref
->sizrange
[1] = bounds
[1];
750 if (bounds
[0] < srcref
->sizrange
[0])
751 srcref
->sizrange
[0] = bounds
[0];
753 if (bounds
[1] < srcref
->sizrange
[1])
754 srcref
->sizrange
[1] = bounds
[1];
759 builtin_access::overlap_size (const offset_int a
[2], const offset_int b
[2],
762 const offset_int
*p
= a
;
763 const offset_int
*q
= b
;
765 /* Point P at the bigger of the two ranges and Q at the smaller. */
766 if (wi::lts_p (a
[1] - a
[0], b
[1] - b
[0]))
778 return wi::smin (p
[1], q
[1]) - q
[0];
788 /* Return true if the bounded mempry (memcpy amd similar) or string function
789 access (strncpy and similar) ACS overlaps. */
792 builtin_access::generic_overlap ()
794 builtin_access
&acs
= *this;
795 const builtin_memref
*dstref
= acs
.dstref
;
796 const builtin_memref
*srcref
= acs
.srcref
;
798 gcc_assert (dstref
->base
== srcref
->base
);
800 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
802 offset_int maxsize
= dstref
->basesize
< 0 ? maxobjsize
: dstref
->basesize
;
803 gcc_assert (maxsize
<= maxobjsize
);
805 /* Adjust the larger bounds of the offsets (which may be the first
806 element if the lower bound is larger than the upper bound) to
807 make them valid for the smallest access (if possible) but no smaller
808 than the smaller bounds. */
809 gcc_assert (wi::les_p (acs
.dstoff
[0], acs
.dstoff
[1]));
811 if (maxsize
< acs
.dstoff
[1] + acs
.dstsiz
[0])
812 acs
.dstoff
[1] = maxsize
- acs
.dstsiz
[0];
813 if (acs
.dstoff
[1] < acs
.dstoff
[0])
814 acs
.dstoff
[1] = acs
.dstoff
[0];
816 gcc_assert (wi::les_p (acs
.srcoff
[0], acs
.srcoff
[1]));
818 if (maxsize
< acs
.srcoff
[1] + acs
.srcsiz
[0])
819 acs
.srcoff
[1] = maxsize
- acs
.srcsiz
[0];
820 if (acs
.srcoff
[1] < acs
.srcoff
[0])
821 acs
.srcoff
[1] = acs
.srcoff
[0];
823 /* Determine the minimum and maximum space for the access given
826 space
[0] = wi::abs (acs
.dstoff
[0] - acs
.srcoff
[0]);
829 offset_int d
= wi::abs (acs
.dstoff
[0] - acs
.srcoff
[1]);
830 if (acs
.srcsiz
[0] > 0)
839 space
[1] = acs
.dstsiz
[1];
841 d
= wi::abs (acs
.dstoff
[1] - acs
.srcoff
[0]);
848 /* Treat raw memory functions both of whose references are bounded
849 as special and permit uncertain overlaps to go undetected. For
850 all kinds of constant offset and constant size accesses, if
851 overlap isn't certain it is not possible. */
852 bool overlap_possible
= space
[0] < acs
.dstsiz
[1];
853 if (!overlap_possible
)
856 bool overlap_certain
= space
[1] < acs
.dstsiz
[0];
858 /* True when the size of one reference depends on the offset of
860 bool depends_p
= detect_overlap
!= &builtin_access::generic_overlap
;
863 && !dstref
->strbounded_p
867 /* True for stpcpy and strcpy. */
868 bool stxcpy_p
= (!dstref
->strbounded_p
869 && detect_overlap
== &builtin_access::strcpy_overlap
);
871 if (dstref
->refoff
>= 0
872 && srcref
->refoff
>= 0
873 && dstref
->refoff
!= srcref
->refoff
874 && (stxcpy_p
|| dstref
->strbounded_p
|| srcref
->strbounded_p
))
877 offset_int siz
[2] = { maxobjsize
+ 1, 0 };
879 ovloff
[0] = HOST_WIDE_INT_MAX
;
880 ovloff
[1] = HOST_WIDE_INT_MIN
;
882 /* Adjustment to the lower bound of the offset of the overlap to
883 account for a subset of unbounded string calls where the size
884 of the destination string depends on the length of the source
885 which in turn depends on the offset into it. */
890 sub1
= acs
.dstoff
[0] <= acs
.srcoff
[0];
892 /* Iterate over the extreme locations (on the horizontal axis formed
893 by their offsets) and sizes of two regions and find their smallest
894 and largest overlap and the corresponding offsets. */
895 for (unsigned i
= 0; i
!= 2; ++i
)
897 const offset_int a
[2] = {
898 acs
.dstoff
[i
], acs
.dstoff
[i
] + acs
.dstsiz
[!i
]
901 const offset_int b
[2] = {
902 acs
.srcoff
[i
], acs
.srcoff
[i
] + acs
.srcsiz
[!i
]
906 offset_int sz
= overlap_size (a
, b
, &off
);
915 if (wi::lts_p (off
, ovloff
[0]))
916 ovloff
[0] = off
.to_shwi ();
917 if (wi::lts_p (ovloff
[1], off
))
918 ovloff
[1] = off
.to_shwi ();
926 /* Iterate over the extreme locations (on the horizontal axis
927 formed by their offsets) and sizes of two regions and find
928 their smallest and largest overlap and the corresponding
931 for (unsigned io
= 0; io
!= 2; ++io
)
932 for (unsigned is
= 0; is
!= 2; ++is
)
934 const offset_int a
[2] = {
935 acs
.dstoff
[io
], acs
.dstoff
[io
] + acs
.dstsiz
[is
]
938 for (unsigned jo
= 0; jo
!= 2; ++jo
)
939 for (unsigned js
= 0; js
!= 2; ++js
)
943 /* For st{p,r}ncpy the size of the source sequence
944 depends on the offset into it. */
950 const offset_int b
[2] = {
951 acs
.srcoff
[jo
], acs
.srcoff
[jo
] + acs
.srcsiz
[js
]
955 offset_int sz
= overlap_size (a
, b
, &off
);
964 if (wi::lts_p (off
, ovloff
[0]))
965 ovloff
[0] = off
.to_shwi ();
966 if (wi::lts_p (ovloff
[1], off
))
967 ovloff
[1] = off
.to_shwi ();
973 ovlsiz
[0] = siz
[0].to_shwi ();
974 ovlsiz
[1] = siz
[1].to_shwi ();
976 if (ovlsiz
[0] == 0 && ovlsiz
[1] > 1)
977 ovloff
[0] = ovloff
[1] + ovlsiz
[1] - 1 - sub1
;
982 /* Return true if the strcat-like access overlaps. */
985 builtin_access::strcat_overlap ()
987 builtin_access
&acs
= *this;
988 const builtin_memref
*dstref
= acs
.dstref
;
989 const builtin_memref
*srcref
= acs
.srcref
;
991 gcc_assert (dstref
->base
== srcref
->base
);
993 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
995 gcc_assert (dstref
->base
&& dstref
->base
== srcref
->base
);
997 /* Adjust for strcat-like accesses. */
999 /* As a special case for strcat, set the DSTREF offsets to the length
1000 of the source string since the function starts writing at the first
1001 nul, and set the size to 1 for the length of the nul. */
1002 acs
.dstoff
[0] += acs
.dstsiz
[0];
1003 acs
.dstoff
[1] += acs
.dstsiz
[1];
1005 bool strfunc_unknown_args
= acs
.dstsiz
[0] == 0 && acs
.dstsiz
[1] != 0;
1007 /* The lower bound is zero when the size is unknown because then
1008 overlap is not certain. */
1009 acs
.dstsiz
[0] = strfunc_unknown_args
? 0 : 1;
1012 offset_int maxsize
= dstref
->basesize
< 0 ? maxobjsize
: dstref
->basesize
;
1013 gcc_assert (maxsize
<= maxobjsize
);
1015 /* For references to the same base object, determine if there's a pair
1016 of valid offsets into the two references such that access between
1017 them doesn't overlap. Adjust both upper bounds to be valid for
1018 the smaller size (i.e., at most MAXSIZE - SIZE). */
1020 if (maxsize
< acs
.dstoff
[1] + acs
.dstsiz
[0])
1021 acs
.dstoff
[1] = maxsize
- acs
.dstsiz
[0];
1023 if (maxsize
< acs
.srcoff
[1] + acs
.srcsiz
[0])
1024 acs
.srcoff
[1] = maxsize
- acs
.srcsiz
[0];
1026 /* Check to see if there's enough space for both accesses without
1027 overlap. Determine the optimistic (maximum) amount of available
1030 if (acs
.dstoff
[0] <= acs
.srcoff
[0])
1032 if (acs
.dstoff
[1] < acs
.srcoff
[1])
1033 space
= acs
.srcoff
[1] + acs
.srcsiz
[0] - acs
.dstoff
[0];
1035 space
= acs
.dstoff
[1] + acs
.dstsiz
[0] - acs
.srcoff
[0];
1038 space
= acs
.dstoff
[1] + acs
.dstsiz
[0] - acs
.srcoff
[0];
1040 /* Overlap is certain if the distance between the farthest offsets
1041 of the opposite accesses is less than the sum of the lower bounds
1042 of the sizes of the two accesses. */
1043 bool overlap_certain
= space
< acs
.dstsiz
[0] + acs
.srcsiz
[0];
1045 /* For a constant-offset, constant size access, consider the largest
1046 distance between the offset bounds and the lower bound of the access
1047 size. If the overlap isn't certain return success. */
1048 if (!overlap_certain
1049 && acs
.dstoff
[0] == acs
.dstoff
[1]
1050 && acs
.srcoff
[0] == acs
.srcoff
[1]
1051 && acs
.dstsiz
[0] == acs
.dstsiz
[1]
1052 && acs
.srcsiz
[0] == acs
.srcsiz
[1])
1055 /* Overlap is not certain but may be possible. */
1057 offset_int access_min
= acs
.dstsiz
[0] + acs
.srcsiz
[0];
1059 /* Determine the conservative (minimum) amount of space. */
1060 space
= wi::abs (acs
.dstoff
[0] - acs
.srcoff
[0]);
1061 offset_int d
= wi::abs (acs
.dstoff
[0] - acs
.srcoff
[1]);
1064 d
= wi::abs (acs
.dstoff
[1] - acs
.srcoff
[0]);
1068 /* For a strict test (used for strcpy and similar with unknown or
1069 variable bounds or sizes), consider the smallest distance between
1070 the offset bounds and either the upper bound of the access size
1071 if known, or the lower bound otherwise. */
1072 if (access_min
<= space
&& (access_min
!= 0 || !strfunc_unknown_args
))
1075 /* When strcat overlap is certain it is always a single byte:
1076 the terminatinn NUL, regardless of offsets and sizes. When
1077 overlap is only possible its range is [0, 1]. */
1078 acs
.ovlsiz
[0] = dstref
->sizrange
[0] == dstref
->sizrange
[1] ? 1 : 0;
1080 acs
.ovloff
[0] = (dstref
->sizrange
[0] + dstref
->offrange
[0]).to_shwi ();
1081 acs
.ovloff
[1] = (dstref
->sizrange
[1] + dstref
->offrange
[1]).to_shwi ();
1083 acs
.sizrange
[0] = wi::smax (acs
.dstsiz
[0], srcref
->sizrange
[0]).to_shwi ();
1084 acs
.sizrange
[1] = wi::smax (acs
.dstsiz
[1], srcref
->sizrange
[1]).to_shwi ();
1088 /* Return true if the strcpy-like access overlaps. */
1091 builtin_access::strcpy_overlap ()
1093 return generic_overlap ();
1097 /* Return true if DSTREF and SRCREF describe accesses that either overlap
1098 one another or that, in order not to overlap, would imply that the size
1099 of the referenced object(s) exceeds the maximum size of an object. Set
1100 Otherwise, if DSTREF and SRCREF do not definitely overlap (even though
1101 they may overlap in a way that's not apparent from the available data),
1105 builtin_access::overlap ()
1107 builtin_access
&acs
= *this;
1109 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
1111 acs
.sizrange
[0] = wi::smax (dstref
->sizrange
[0],
1112 srcref
->sizrange
[0]).to_shwi ();
1113 acs
.sizrange
[1] = wi::smax (dstref
->sizrange
[1],
1114 srcref
->sizrange
[1]).to_shwi ();
1116 /* Check to see if the two references refer to regions that are
1117 too large not to overlap in the address space (whose maximum
1118 size is PTRDIFF_MAX). */
1119 offset_int size
= dstref
->sizrange
[0] + srcref
->sizrange
[0];
1120 if (maxobjsize
< size
)
1122 acs
.ovloff
[0] = (maxobjsize
- dstref
->sizrange
[0]).to_shwi ();
1123 acs
.ovlsiz
[0] = (size
- maxobjsize
).to_shwi ();
1127 /* If both base objects aren't known return the maximum possible
1128 offset that would make them not overlap. */
1129 if (!dstref
->base
|| !srcref
->base
)
1132 /* Set the access offsets. */
1133 acs
.dstoff
[0] = dstref
->offrange
[0];
1134 acs
.dstoff
[1] = dstref
->offrange
[1];
1136 /* If the base object is an array adjust the bounds of the offset
1137 to be non-negative and within the bounds of the array if possible. */
1139 && TREE_CODE (TREE_TYPE (dstref
->base
)) == ARRAY_TYPE
)
1141 if (acs
.dstoff
[0] < 0 && acs
.dstoff
[1] >= 0)
1144 if (acs
.dstoff
[1] < acs
.dstoff
[0])
1146 if (tree size
= TYPE_SIZE_UNIT (TREE_TYPE (dstref
->base
)))
1147 acs
.dstoff
[1] = wi::umin (acs
.dstoff
[1], wi::to_offset (size
));
1149 acs
.dstoff
[1] = wi::umin (acs
.dstoff
[1], maxobjsize
);
1153 acs
.srcoff
[0] = srcref
->offrange
[0];
1154 acs
.srcoff
[1] = srcref
->offrange
[1];
1157 && TREE_CODE (TREE_TYPE (srcref
->base
)) == ARRAY_TYPE
)
1159 if (acs
.srcoff
[0] < 0 && acs
.srcoff
[1] >= 0)
1162 if (tree size
= TYPE_SIZE_UNIT (TREE_TYPE (srcref
->base
)))
1163 acs
.srcoff
[1] = wi::umin (acs
.srcoff
[1], wi::to_offset (size
));
1164 else if (acs
.srcoff
[1] < acs
.srcoff
[0])
1165 acs
.srcoff
[1] = wi::umin (acs
.srcoff
[1], maxobjsize
);
1168 /* When the upper bound of the offset is less than the lower bound
1169 the former is the result of a negative offset being represented
1170 as a large positive value or vice versa. The resulting range is
1171 a union of two subranges: [MIN, UB] and [LB, MAX]. Since such
1172 a union is not representable using the current data structure
1173 replace it with the full range of offsets. */
1174 if (acs
.dstoff
[1] < acs
.dstoff
[0])
1176 acs
.dstoff
[0] = -maxobjsize
- 1;
1177 acs
.dstoff
[1] = maxobjsize
;
1180 /* Validate the offset and size of each reference on its own first.
1181 This is independent of whether or not the base objects are the
1182 same. Normally, this would have already been detected and
1183 diagnosed by -Warray-bounds, unless it has been disabled. */
1184 offset_int maxoff
= acs
.dstoff
[0] + dstref
->sizrange
[0];
1185 if (maxobjsize
< maxoff
)
1187 acs
.ovlsiz
[0] = (maxoff
- maxobjsize
).to_shwi ();
1188 acs
.ovloff
[0] = acs
.dstoff
[0].to_shwi () - acs
.ovlsiz
[0];
1192 /* Repeat the same as above but for the source offsets. */
1193 if (acs
.srcoff
[1] < acs
.srcoff
[0])
1195 acs
.srcoff
[0] = -maxobjsize
- 1;
1196 acs
.srcoff
[1] = maxobjsize
;
1199 maxoff
= acs
.srcoff
[0] + srcref
->sizrange
[0];
1200 if (maxobjsize
< maxoff
)
1202 acs
.ovlsiz
[0] = (maxoff
- maxobjsize
).to_shwi ();
1203 acs
.ovlsiz
[1] = (acs
.srcoff
[0] + srcref
->sizrange
[1]
1204 - maxobjsize
).to_shwi ();
1205 acs
.ovloff
[0] = acs
.srcoff
[0].to_shwi () - acs
.ovlsiz
[0];
1209 if (dstref
->base
!= srcref
->base
)
1212 acs
.dstsiz
[0] = dstref
->sizrange
[0];
1213 acs
.dstsiz
[1] = dstref
->sizrange
[1];
1215 acs
.srcsiz
[0] = srcref
->sizrange
[0];
1216 acs
.srcsiz
[1] = srcref
->sizrange
[1];
1218 /* Call the appropriate function to determine the overlap. */
1219 if ((this->*detect_overlap
) ())
1221 sizrange
[0] = wi::smax (acs
.dstsiz
[0], srcref
->sizrange
[0]).to_shwi ();
1222 sizrange
[1] = wi::smax (acs
.dstsiz
[1], srcref
->sizrange
[1]).to_shwi ();
1229 /* Attempt to detect and diagnose an overlapping copy in a call expression
1230 EXPR involving an an access ACS to a built-in memory or string function.
1231 Return true when one has been detected, false otherwise. */
1234 maybe_diag_overlap (location_t loc
, gcall
*call
, builtin_access
&acs
)
1236 if (!acs
.overlap ())
1239 /* For convenience. */
1240 const builtin_memref
&dstref
= *acs
.dstref
;
1241 const builtin_memref
&srcref
= *acs
.srcref
;
1243 /* Determine the range of offsets and sizes of the overlap if it
1244 exists and issue diagnostics. */
1245 HOST_WIDE_INT
*ovloff
= acs
.ovloff
;
1246 HOST_WIDE_INT
*ovlsiz
= acs
.ovlsiz
;
1247 HOST_WIDE_INT
*sizrange
= acs
.sizrange
;
1249 tree func
= gimple_call_fndecl (call
);
1251 /* To avoid a combinatorial explosion of diagnostics format the offsets
1252 or their ranges as strings and use them in the warning calls below. */
1255 if (dstref
.offrange
[0] == dstref
.offrange
[1]
1256 || dstref
.offrange
[1] > HOST_WIDE_INT_MAX
)
1257 sprintf (offstr
[0], HOST_WIDE_INT_PRINT_DEC
,
1258 dstref
.offrange
[0].to_shwi ());
1261 "[" HOST_WIDE_INT_PRINT_DEC
", " HOST_WIDE_INT_PRINT_DEC
"]",
1262 dstref
.offrange
[0].to_shwi (),
1263 dstref
.offrange
[1].to_shwi ());
1265 if (srcref
.offrange
[0] == srcref
.offrange
[1]
1266 || srcref
.offrange
[1] > HOST_WIDE_INT_MAX
)
1268 HOST_WIDE_INT_PRINT_DEC
,
1269 srcref
.offrange
[0].to_shwi ());
1272 "[" HOST_WIDE_INT_PRINT_DEC
", " HOST_WIDE_INT_PRINT_DEC
"]",
1273 srcref
.offrange
[0].to_shwi (),
1274 srcref
.offrange
[1].to_shwi ());
1276 if (ovloff
[0] == ovloff
[1] || !ovloff
[1])
1277 sprintf (offstr
[2], HOST_WIDE_INT_PRINT_DEC
, ovloff
[0]);
1280 "[" HOST_WIDE_INT_PRINT_DEC
", " HOST_WIDE_INT_PRINT_DEC
"]",
1281 ovloff
[0], ovloff
[1]);
1283 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
1284 bool must_overlap
= ovlsiz
[0] > 0;
1287 ovlsiz
[1] = ovlsiz
[0];
1291 /* Issue definitive "overlaps" diagnostic in this block. */
1293 if (sizrange
[0] == sizrange
[1])
1295 if (ovlsiz
[0] == ovlsiz
[1])
1296 warning_at (loc
, OPT_Wrestrict
,
1299 ? G_("%G%qD accessing %wu byte at offsets %s "
1300 "and %s overlaps %wu byte at offset %s")
1301 : G_("%G%qD accessing %wu byte at offsets %s "
1302 "and %s overlaps %wu bytes at offset "
1305 ? G_("%G%qD accessing %wu bytes at offsets %s "
1306 "and %s overlaps %wu byte at offset %s")
1307 : G_("%G%qD accessing %wu bytes at offsets %s "
1308 "and %s overlaps %wu bytes at offset "
1310 call
, func
, sizrange
[0],
1311 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1312 else if (ovlsiz
[1] >= 0 && ovlsiz
[1] < maxobjsize
.to_shwi ())
1313 warning_at (loc
, OPT_Wrestrict
,
1315 ? G_("%G%qD accessing %wu byte at offsets %s "
1316 "and %s overlaps between %wu and %wu bytes "
1318 : G_("%G%qD accessing %wu bytes at offsets %s "
1319 "and %s overlaps between %wu and %wu bytes "
1321 call
, func
, sizrange
[0],
1322 offstr
[0], offstr
[1], ovlsiz
[0], ovlsiz
[1],
1325 warning_at (loc
, OPT_Wrestrict
,
1327 ? G_("%G%qD accessing %wu byte at offsets %s and "
1328 "%s overlaps %wu or more bytes at offset %s")
1329 : G_("%G%qD accessing %wu bytes at offsets %s and "
1330 "%s overlaps %wu or more bytes at offset %s"),
1331 call
, func
, sizrange
[0],
1332 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1336 if (sizrange
[1] >= 0 && sizrange
[1] < maxobjsize
.to_shwi ())
1338 if (ovlsiz
[0] == ovlsiz
[1])
1339 warning_at (loc
, OPT_Wrestrict
,
1341 ? G_("%G%qD accessing between %wu and %wu bytes "
1342 "at offsets %s and %s overlaps %wu byte at "
1344 : G_("%G%qD accessing between %wu and %wu bytes "
1345 "at offsets %s and %s overlaps %wu bytes "
1347 call
, func
, sizrange
[0], sizrange
[1],
1348 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1349 else if (ovlsiz
[1] >= 0 && ovlsiz
[1] < maxobjsize
.to_shwi ())
1350 warning_at (loc
, OPT_Wrestrict
,
1351 "%G%qD accessing between %wu and %wu bytes at "
1352 "offsets %s and %s overlaps between %wu and %wu "
1353 "bytes at offset %s",
1354 call
, func
, sizrange
[0], sizrange
[1],
1355 offstr
[0], offstr
[1], ovlsiz
[0], ovlsiz
[1],
1358 warning_at (loc
, OPT_Wrestrict
,
1359 "%G%qD accessing between %wu and %wu bytes at "
1360 "offsets %s and %s overlaps %wu or more bytes "
1362 call
, func
, sizrange
[0], sizrange
[1],
1363 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1367 if (ovlsiz
[0] != ovlsiz
[1])
1368 ovlsiz
[1] = maxobjsize
.to_shwi ();
1370 if (ovlsiz
[0] == ovlsiz
[1])
1371 warning_at (loc
, OPT_Wrestrict
,
1373 ? G_("%G%qD accessing %wu or more bytes at offsets "
1374 "%s and %s overlaps %wu byte at offset %s")
1375 : G_("%G%qD accessing %wu or more bytes at offsets "
1376 "%s and %s overlaps %wu bytes at offset %s"),
1377 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1378 ovlsiz
[0], offstr
[2]);
1379 else if (ovlsiz
[1] >= 0 && ovlsiz
[1] < maxobjsize
.to_shwi ())
1380 warning_at (loc
, OPT_Wrestrict
,
1381 "%G%qD accessing %wu or more bytes at offsets %s "
1382 "and %s overlaps between %wu and %wu bytes "
1384 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1385 ovlsiz
[0], ovlsiz
[1], offstr
[2]);
1387 warning_at (loc
, OPT_Wrestrict
,
1388 "%G%qD accessing %wu or more bytes at offsets %s "
1389 "and %s overlaps %wu or more bytes at offset %s",
1390 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1391 ovlsiz
[0], offstr
[2]);
1395 /* Use more concise wording when one of the offsets is unbounded
1396 to avoid confusing the user with large and mostly meaningless
1398 bool open_range
= ((dstref
.offrange
[0] == -maxobjsize
- 1
1399 && dstref
.offrange
[1] == maxobjsize
)
1400 || (srcref
.offrange
[0] == -maxobjsize
- 1
1401 && srcref
.offrange
[1] == maxobjsize
));
1403 if (sizrange
[0] == sizrange
[1] || sizrange
[1] == 1)
1408 warning_at (loc
, OPT_Wrestrict
,
1410 ? G_("%G%qD accessing %wu byte may overlap "
1412 : G_("%G%qD accessing %wu bytes may overlap "
1414 call
, func
, sizrange
[1], ovlsiz
[1]);
1416 warning_at (loc
, OPT_Wrestrict
,
1418 ? G_("%G%qD accessing %wu byte at offsets %s "
1419 "and %s may overlap %wu byte at offset %s")
1420 : G_("%G%qD accessing %wu bytes at offsets %s "
1421 "and %s may overlap %wu byte at offset %s"),
1422 call
, func
, sizrange
[1], offstr
[0], offstr
[1],
1423 ovlsiz
[1], offstr
[2]);
1428 warning_at (loc
, OPT_Wrestrict
,
1430 ? G_("%G%qD accessing %wu byte may overlap "
1432 : G_("%G%qD accessing %wu bytes may overlap "
1434 call
, func
, sizrange
[1], ovlsiz
[1]);
1436 warning_at (loc
, OPT_Wrestrict
,
1438 ? G_("%G%qD accessing %wu byte at offsets %s and "
1439 "%s may overlap up to %wu bytes at offset %s")
1440 : G_("%G%qD accessing %wu bytes at offsets %s and "
1441 "%s may overlap up to %wu bytes at offset %s"),
1442 call
, func
, sizrange
[1], offstr
[0], offstr
[1],
1443 ovlsiz
[1], offstr
[2]);
1447 if (sizrange
[1] >= 0 && sizrange
[1] < maxobjsize
.to_shwi ())
1450 warning_at (loc
, OPT_Wrestrict
,
1452 ? G_("%G%qD accessing between %wu and %wu bytes "
1453 "may overlap %wu byte")
1454 : G_("%G%qD accessing between %wu and %wu bytes "
1455 "may overlap up to %wu bytes"),
1456 call
, func
, sizrange
[0], sizrange
[1], ovlsiz
[1]);
1458 warning_at (loc
, OPT_Wrestrict
,
1460 ? G_("%G%qD accessing between %wu and %wu bytes "
1461 "at offsets %s and %s may overlap %wu byte "
1463 : G_("%G%qD accessing between %wu and %wu bytes "
1464 "at offsets %s and %s may overlap up to %wu "
1465 "bytes at offset %s"),
1466 call
, func
, sizrange
[0], sizrange
[1],
1467 offstr
[0], offstr
[1], ovlsiz
[1], offstr
[2]);
1471 warning_at (loc
, OPT_Wrestrict
,
1473 ? G_("%G%qD accessing %wu or more bytes at offsets %s "
1474 "and %s may overlap %wu byte at offset %s")
1475 : G_("%G%qD accessing %wu or more bytes at offsets %s "
1476 "and %s may overlap up to %wu bytes at offset %s"),
1477 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1478 ovlsiz
[1], offstr
[2]);
1483 /* Validate REF offsets in an EXPRession passed as an argument to a CALL
1484 to a built-in function FUNC to make sure they are within the bounds
1485 of the referenced object if its size is known, or PTRDIFF_MAX otherwise.
1486 Both initial values of the offsets and their final value computed by
1487 the function by incrementing the initial value by the size are
1488 validated. Return true if the offsets are not valid and a diagnostic
1492 maybe_diag_offset_bounds (location_t loc
, gcall
*call
, tree func
, int strict
,
1493 tree expr
, const builtin_memref
&ref
)
1495 if (!warn_array_bounds
)
1498 offset_int ooboff
[] = { ref
.offrange
[0], ref
.offrange
[1] };
1499 tree oobref
= ref
.offset_out_of_bounds (strict
, ooboff
);
1503 if (EXPR_HAS_LOCATION (expr
))
1504 loc
= EXPR_LOCATION (expr
);
1506 loc
= expansion_point_location_if_in_system_header (loc
);
1510 char rangestr
[2][64];
1511 if (ooboff
[0] == ooboff
[1]
1512 || (ooboff
[0] != ref
.offrange
[0]
1513 && ooboff
[0].to_shwi () >= ooboff
[1].to_shwi ()))
1514 sprintf (rangestr
[0], "%lli", (long long) ooboff
[0].to_shwi ());
1516 sprintf (rangestr
[0], "[%lli, %lli]",
1517 (long long) ooboff
[0].to_shwi (),
1518 (long long) ooboff
[1].to_shwi ());
1520 if (oobref
== error_mark_node
)
1522 if (ref
.sizrange
[0] == ref
.sizrange
[1])
1523 sprintf (rangestr
[1], "%lli", (long long) ref
.sizrange
[0].to_shwi ());
1525 sprintf (rangestr
[1], "[%lli, %lli]",
1526 (long long) ref
.sizrange
[0].to_shwi (),
1527 (long long) ref
.sizrange
[1].to_shwi ());
1529 if (DECL_P (ref
.base
)
1530 && TREE_CODE (type
= TREE_TYPE (ref
.base
)) == ARRAY_TYPE
)
1532 if (warning_at (loc
, OPT_Warray_bounds
,
1533 "%G%qD pointer overflow between offset %s "
1534 "and size %s accessing array %qD with type %qT",
1535 call
, func
, rangestr
[0], rangestr
[1], ref
.base
, type
))
1536 inform (DECL_SOURCE_LOCATION (ref
.base
),
1537 "array %qD declared here", ref
.base
);
1539 warning_at (loc
, OPT_Warray_bounds
,
1540 "%G%qD pointer overflow between offset %s "
1542 call
, func
, rangestr
[0], rangestr
[1]);
1545 warning_at (loc
, OPT_Warray_bounds
,
1546 "%G%qD pointer overflow between offset %s "
1548 call
, func
, rangestr
[0], rangestr
[1]);
1550 else if (oobref
== ref
.base
)
1552 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
1554 /* True when the offset formed by an access to the reference
1555 is out of bounds, rather than the initial offset wich is
1556 in bounds. This implies access past the end. */
1557 bool form
= ooboff
[0] != ref
.offrange
[0];
1559 if (DECL_P (ref
.base
))
1561 if ((ref
.basesize
< maxobjsize
1562 && warning_at (loc
, OPT_Warray_bounds
,
1564 ? G_("%G%qD forming offset %s is out of "
1565 "the bounds [0, %wu] of object %qD with "
1567 : G_("%G%qD offset %s is out of the bounds "
1568 "[0, %wu] of object %qD with type %qT"),
1569 call
, func
, rangestr
[0], ref
.basesize
.to_uhwi (),
1570 ref
.base
, TREE_TYPE (ref
.base
)))
1571 || warning_at (loc
, OPT_Warray_bounds
,
1573 ? G_("%G%qD forming offset %s is out of "
1574 "the bounds of object %qD with type %qT")
1575 : G_("%G%qD offset %s is out of the bounds "
1576 "of object %qD with type %qT"),
1577 call
, func
, rangestr
[0],
1578 ref
.base
, TREE_TYPE (ref
.base
)))
1579 inform (DECL_SOURCE_LOCATION (ref
.base
),
1580 "%qD declared here", ref
.base
);
1582 else if (ref
.basesize
< maxobjsize
)
1583 warning_at (loc
, OPT_Warray_bounds
,
1585 ? G_("%G%qD forming offset %s is out of the bounds "
1587 : G_("%G%qD offset %s is out of the bounds [0, %wu]"),
1588 call
, func
, rangestr
[0], ref
.basesize
.to_uhwi ());
1590 warning_at (loc
, OPT_Warray_bounds
,
1592 ? G_("%G%qD forming offset %s is out of bounds")
1593 : G_("%G%qD offset %s is out of bounds"),
1594 call
, func
, rangestr
[0]);
1596 else if (TREE_CODE (ref
.ref
) == MEM_REF
)
1598 tree type
= TREE_TYPE (TREE_OPERAND (ref
.ref
, 0));
1599 if (POINTER_TYPE_P (type
))
1600 type
= TREE_TYPE (type
);
1601 type
= TYPE_MAIN_VARIANT (type
);
1603 warning_at (loc
, OPT_Warray_bounds
,
1604 "%G%qD offset %s from the object at %qE is out "
1605 "of the bounds of %qT",
1606 call
, func
, rangestr
[0], ref
.base
, type
);
1610 type
= TYPE_MAIN_VARIANT (TREE_TYPE (ref
.ref
));
1612 warning_at (loc
, OPT_Warray_bounds
,
1613 "%G%qD offset %s from the object at %qE is out "
1614 "of the bounds of referenced subobject %qD with type %qT "
1616 call
, func
, rangestr
[0], ref
.base
, TREE_OPERAND (ref
.ref
, 1),
1617 type
, ref
.refoff
.to_uhwi ());
1623 /* Check a CALL statement for restrict-violations and issue warnings
1624 if/when appropriate. */
1627 wrestrict_dom_walker::check_call (gcall
*call
)
1629 /* Avoid checking the call if it has already been diagnosed for
1631 if (gimple_no_warning_p (call
))
1634 tree func
= gimple_call_fndecl (call
);
1635 if (!func
|| DECL_BUILT_IN_CLASS (func
) != BUILT_IN_NORMAL
)
1638 bool with_bounds
= gimple_call_with_bounds_p (call
);
1640 /* Argument number to extract from the call (depends on the built-in
1642 unsigned dst_idx
= -1;
1643 unsigned src_idx
= -1;
1644 unsigned bnd_idx
= -1;
1646 /* Is this CALL to a string function (as opposed to one to a raw
1647 memory function). */
1650 switch (DECL_FUNCTION_CODE (func
))
1652 case BUILT_IN_MEMCPY
:
1653 case BUILT_IN_MEMCPY_CHK
:
1654 case BUILT_IN_MEMCPY_CHKP
:
1655 case BUILT_IN_MEMCPY_CHK_CHKP
:
1656 case BUILT_IN_MEMPCPY
:
1657 case BUILT_IN_MEMPCPY_CHK
:
1658 case BUILT_IN_MEMPCPY_CHKP
:
1659 case BUILT_IN_MEMPCPY_CHK_CHKP
:
1660 case BUILT_IN_MEMMOVE
:
1661 case BUILT_IN_MEMMOVE_CHK
:
1662 case BUILT_IN_MEMMOVE_CHKP
:
1663 case BUILT_IN_MEMMOVE_CHK_CHKP
:
1667 case BUILT_IN_STPNCPY
:
1668 case BUILT_IN_STPNCPY_CHK
:
1669 case BUILT_IN_STRNCAT
:
1670 case BUILT_IN_STRNCAT_CHK
:
1671 case BUILT_IN_STRNCPY
:
1672 case BUILT_IN_STRNCPY_CHK
:
1674 src_idx
= 1 + with_bounds
;
1675 bnd_idx
= 2 + 2 * with_bounds
;
1678 case BUILT_IN_STPCPY
:
1679 case BUILT_IN_STPCPY_CHK
:
1680 case BUILT_IN_STPCPY_CHKP
:
1681 case BUILT_IN_STPCPY_CHK_CHKP
:
1682 case BUILT_IN_STRCPY
:
1683 case BUILT_IN_STRCPY_CHK
:
1684 case BUILT_IN_STRCPY_CHKP
:
1685 case BUILT_IN_STRCPY_CHK_CHKP
:
1686 case BUILT_IN_STRCAT
:
1687 case BUILT_IN_STRCAT_CHK
:
1688 case BUILT_IN_STRCAT_CHKP
:
1689 case BUILT_IN_STRCAT_CHK_CHKP
:
1691 src_idx
= 1 + with_bounds
;
1695 /* Handle other string functions here whose access may need
1696 to be validated for in-bounds offsets and non-overlapping
1697 copies. (Not all _chkp functions have BUILT_IN_XXX_CHKP
1698 macros so they need to be handled here.) */
1702 unsigned nargs
= gimple_call_num_args (call
);
1704 tree dst
= dst_idx
< nargs
? gimple_call_arg (call
, dst_idx
) : NULL_TREE
;
1705 tree src
= src_idx
< nargs
? gimple_call_arg (call
, src_idx
) : NULL_TREE
;
1706 tree dstwr
= bnd_idx
< nargs
? gimple_call_arg (call
, bnd_idx
) : NULL_TREE
;
1708 /* For string functions with an unspecified or unknown bound,
1709 assume the size of the access is one. */
1710 if (!dstwr
&& strfun
)
1711 dstwr
= size_one_node
;
1713 /* DST and SRC can be null for a call with an insufficient number
1714 of arguments to a built-in function declared without a protype. */
1718 /* DST, SRC, or DSTWR can also have the wrong type in a call to
1719 a function declared without a prototype. Avoid checking such
1721 if (TREE_CODE (TREE_TYPE (dst
)) != POINTER_TYPE
1722 || TREE_CODE (TREE_TYPE (src
)) != POINTER_TYPE
1723 || (dstwr
&& !INTEGRAL_TYPE_P (TREE_TYPE (dstwr
))))
1726 if (check_bounds_or_overlap (call
, dst
, src
, dstwr
, NULL_TREE
))
1729 /* Avoid diagnosing the call again. */
1730 gimple_set_no_warning (call
, true);
1733 } /* anonymous namespace */
1735 /* Attempt to detect and diagnose invalid offset bounds and (except for
1736 memmove) overlapping copy in a call expression EXPR from SRC to DST
1737 and DSTSIZE and SRCSIZE bytes, respectively. Both DSTSIZE and
1738 SRCSIZE may be NULL. Return false when one or the other has been
1739 detected and diagnosed, true otherwise. */
1742 check_bounds_or_overlap (gcall
*call
, tree dst
, tree src
, tree dstsize
,
1743 tree srcsize
, bool bounds_only
/* = false */)
1745 location_t loc
= gimple_location (call
);
1747 if (tree block
= gimple_block (call
))
1748 if (location_t
*pbloc
= block_nonartificial_location (block
))
1751 loc
= expansion_point_location_if_in_system_header (loc
);
1753 tree func
= gimple_call_fndecl (call
);
1755 builtin_memref
dstref (dst
, dstsize
);
1756 builtin_memref
srcref (src
, srcsize
);
1758 builtin_access
acs (call
, dstref
, srcref
);
1760 /* Set STRICT to the value of the -Warray-bounds=N argument for
1761 string functions or when N > 1. */
1762 int strict
= (acs
.strict () || warn_array_bounds
> 1 ? warn_array_bounds
: 0);
1764 /* Validate offsets first to make sure they are within the bounds
1765 of the destination object if its size is known, or PTRDIFF_MAX
1767 if (maybe_diag_offset_bounds (loc
, call
, func
, strict
, dst
, dstref
)
1768 || maybe_diag_offset_bounds (loc
, call
, func
, strict
, src
, srcref
))
1770 gimple_set_no_warning (call
, true);
1777 || (DECL_FUNCTION_CODE (func
) != BUILT_IN_MEMMOVE
1778 && DECL_FUNCTION_CODE (func
) != BUILT_IN_MEMMOVE_CHK
)));
1783 if (operand_equal_p (dst
, src
, 0))
1785 warning_at (loc
, OPT_Wrestrict
,
1786 "%G%qD source argument is the same as destination",
1788 gimple_set_no_warning (call
, true);
1792 /* Return false when overlap has been detected. */
1793 if (maybe_diag_overlap (loc
, call
, acs
))
1795 gimple_set_no_warning (call
, true);
1803 make_pass_warn_restrict (gcc::context
*ctxt
)
1805 return new pass_wrestrict (ctxt
);