1 /* Pass to detect and issue warnings for violations of the restrict
3 Copyright (C) 2017-2018 Free Software Foundation, Inc.
4 Contributed by Martin Sebor <msebor@redhat.com>.
6 This file is part of GCC.
8 GCC is free software; you can redistribute it and/or modify it under
9 the terms of the GNU General Public License as published by the Free
10 Software Foundation; either version 3, or (at your option) any later
13 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
14 WARRANTY; without even the implied warranty of MERCHANTABILITY or
15 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
18 You should have received a copy of the GNU General Public License
19 along with GCC; see the file COPYING3. If not see
20 <http://www.gnu.org/licenses/>. */
24 #include "coretypes.h"
29 #include "tree-pass.h"
32 #include "gimple-pretty-print.h"
33 #include "gimple-ssa-warn-restrict.h"
34 #include "diagnostic-core.h"
35 #include "fold-const.h"
36 #include "gimple-iterator.h"
41 #include "tree-object-size.h"
48 const pass_data pass_data_wrestrict
= {
53 PROP_cfg
, /* Properties_required. */
54 0, /* properties_provided. */
55 0, /* properties_destroyed. */
56 0, /* properties_start */
57 0, /* properties_finish */
60 /* Pass to detect violations of strict aliasing requirements in calls
61 to built-in string and raw memory functions. */
62 class pass_wrestrict
: public gimple_opt_pass
65 pass_wrestrict (gcc::context
*ctxt
)
66 : gimple_opt_pass (pass_data_wrestrict
, ctxt
)
69 opt_pass
*clone () { return new pass_wrestrict (m_ctxt
); }
71 virtual bool gate (function
*);
72 virtual unsigned int execute (function
*);
76 pass_wrestrict::gate (function
*fun ATTRIBUTE_UNUSED
)
78 return warn_array_bounds
!= 0 || warn_restrict
!= 0;
81 /* Class to walk the basic blocks of a function in dominator order. */
82 class wrestrict_dom_walker
: public dom_walker
85 wrestrict_dom_walker () : dom_walker (CDI_DOMINATORS
) {}
87 edge
before_dom_children (basic_block
) FINAL OVERRIDE
;
88 bool handle_gimple_call (gimple_stmt_iterator
*);
91 void check_call (gcall
*);
95 wrestrict_dom_walker::before_dom_children (basic_block bb
)
97 /* Iterate over statements, looking for function calls. */
98 for (gimple_stmt_iterator si
= gsi_start_bb (bb
); !gsi_end_p (si
);
101 gimple
*stmt
= gsi_stmt (si
);
102 if (!is_gimple_call (stmt
))
105 if (gcall
*call
= as_a
<gcall
*> (stmt
))
112 /* Execute the pass for function FUN, walking in dominator order. */
115 pass_wrestrict::execute (function
*fun
)
117 calculate_dominance_info (CDI_DOMINATORS
);
119 wrestrict_dom_walker walker
;
120 walker
.walk (ENTRY_BLOCK_PTR_FOR_FN (fun
));
125 /* Description of a memory reference by a built-in function. This
126 is similar to ao_ref but made especially suitable for -Wrestrict
127 and not for optimization. */
128 struct builtin_memref
130 /* The original pointer argument to the built-in function. */
132 /* The referenced subobject or NULL if not available, and the base
133 object of the memory reference or NULL. */
137 /* The size of the BASE object, PTRDIFF_MAX if indeterminate,
138 and negative until (possibly lazily) initialized. */
141 /* The non-negative offset of the referenced subobject. Used to avoid
142 warnings for (apparently) possibly but not definitively overlapping
143 accesses to member arrays. Negative when unknown/invalid. */
146 /* The offset range relative to the base. */
147 offset_int offrange
[2];
148 /* The size range of the access to this reference. */
149 offset_int sizrange
[2];
151 /* True for "bounded" string functions like strncat, and strncpy
152 and their variants that specify either an exact or upper bound
153 on the size of the accesses they perform. For strncat both
154 the source and destination references are bounded. For strncpy
155 only the destination reference is. */
158 builtin_memref (tree
, tree
);
160 tree
offset_out_of_bounds (int, offset_int
[2]) const;
164 /* Ctor helper to set or extend OFFRANGE based on argument. */
165 void extend_offset_range (tree
);
167 /* Ctor helper to determine BASE and OFFRANGE from argument. */
168 void set_base_and_offset (tree
);
171 /* Description of a memory access by a raw memory or string built-in
172 function involving a pair of builtin_memref's. */
176 /* Destination and source memory reference. */
177 builtin_memref
* const dstref
;
178 builtin_memref
* const srcref
;
179 /* The size range of the access. It's the greater of the accesses
180 to the two references. */
181 HOST_WIDE_INT sizrange
[2];
183 /* The minimum and maximum offset of an overlap of the access
184 (if it does, in fact, overlap), and the size of the overlap. */
185 HOST_WIDE_INT ovloff
[2];
186 HOST_WIDE_INT ovlsiz
[2];
188 /* True to consider valid only accesses to the smallest subobject
189 and false for raw memory functions. */
192 return detect_overlap
!= &builtin_access::generic_overlap
;
195 builtin_access (gcall
*, builtin_memref
&, builtin_memref
&);
197 /* Entry point to determine overlap. */
201 /* Implementation functions used to determine overlap. */
202 bool generic_overlap ();
203 bool strcat_overlap ();
204 bool strcpy_overlap ();
211 offset_int
overlap_size (const offset_int
[2], const offset_int
[2],
215 /* Temporaries used to compute the final result. */
216 offset_int dstoff
[2];
217 offset_int srcoff
[2];
218 offset_int dstsiz
[2];
219 offset_int srcsiz
[2];
221 /* Pointer to a member function to call to determine overlap. */
222 bool (builtin_access::*detect_overlap
) ();
225 /* Initialize a memory reference representation from a pointer EXPR and
226 a size SIZE in bytes. If SIZE is NULL_TREE then the size is assumed
229 builtin_memref::builtin_memref (tree expr
, tree size
)
234 refoff (HOST_WIDE_INT_MIN
),
239 /* Unfortunately, wide_int default ctor is a no-op so array members
240 of the type must be set individually. */
241 offrange
[0] = offrange
[1] = 0;
242 sizrange
[0] = sizrange
[1] = 0;
244 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
246 /* Find the BASE object or pointer referenced by EXPR and set
247 the offset range OFFRANGE in the process. */
248 set_base_and_offset (expr
);
253 /* Determine the size range, allowing for the result to be [0, 0]
254 for SIZE in the anti-range ~[0, N] where N >= PTRDIFF_MAX. */
255 get_size_range (size
, range
, true);
256 sizrange
[0] = wi::to_offset (range
[0]);
257 sizrange
[1] = wi::to_offset (range
[1]);
258 /* get_size_range returns SIZE_MAX for the maximum size.
259 Constrain it to the real maximum of PTRDIFF_MAX. */
260 if (sizrange
[1] > maxobjsize
)
261 sizrange
[1] = maxobjsize
;
264 sizrange
[1] = maxobjsize
;
269 /* If the offset could be in the range of the referenced object
270 constrain its bounds so neither exceeds those of the object. */
271 if (offrange
[0] < 0 && offrange
[1] > 0)
274 offset_int maxoff
= maxobjsize
;
275 tree basetype
= TREE_TYPE (base
);
276 if (TREE_CODE (basetype
) == ARRAY_TYPE
278 && array_at_struct_end_p (ref
))
279 ; /* Use the maximum possible offset for last member arrays. */
280 else if (tree basesize
= TYPE_SIZE_UNIT (basetype
))
281 if (TREE_CODE (basesize
) == INTEGER_CST
)
282 /* Size could be non-constant for a variable-length type such
283 as a struct with a VLA member (a GCC extension). */
284 maxoff
= wi::to_offset (basesize
);
286 if (offrange
[0] >= 0)
289 offrange
[1] = offrange
[0] <= maxoff
? maxoff
: maxobjsize
;
290 else if (offrange
[0] <= maxoff
&& offrange
[1] > maxoff
)
291 offrange
[1] = maxoff
;
295 /* Ctor helper to set or extend OFFRANGE based on the OFFSET argument. */
298 builtin_memref::extend_offset_range (tree offset
)
300 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
302 if (TREE_CODE (offset
) == INTEGER_CST
)
304 offset_int off
= int_cst_value (offset
);
313 if (TREE_CODE (offset
) == SSA_NAME
)
316 value_range_type rng
= get_range_info (offset
, &min
, &max
);
319 offrange
[0] += offset_int::from (min
, SIGNED
);
320 offrange
[1] += offset_int::from (max
, SIGNED
);
322 else if (rng
== VR_ANTI_RANGE
)
324 offrange
[0] += offset_int::from (max
+ 1, SIGNED
);
325 offrange
[1] += offset_int::from (min
- 1, SIGNED
);
329 gimple
*stmt
= SSA_NAME_DEF_STMT (offset
);
331 if (is_gimple_assign (stmt
)
332 && gimple_assign_rhs_code (stmt
) == NOP_EXPR
333 && (type
= TREE_TYPE (gimple_assign_rhs1 (stmt
)))
334 && INTEGRAL_TYPE_P (type
))
336 /* Use the bounds of the type of the NOP_EXPR operand
337 even if it's signed. The result doesn't trigger
338 warnings but makes their output more readable. */
339 offrange
[0] += wi::to_offset (TYPE_MIN_VALUE (type
));
340 offrange
[1] += wi::to_offset (TYPE_MAX_VALUE (type
));
343 offrange
[1] += maxobjsize
;
348 offrange
[1] += maxobjsize
;
351 /* Determines the base object or pointer of the reference EXPR
352 and the offset range from the beginning of the base. */
355 builtin_memref::set_base_and_offset (tree expr
)
357 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
359 if (TREE_CODE (expr
) == SSA_NAME
)
361 /* Try to tease the offset out of the pointer. */
362 gimple
*stmt
= SSA_NAME_DEF_STMT (expr
);
364 && gimple_assign_single_p (stmt
)
365 && gimple_assign_rhs_code (stmt
) == ADDR_EXPR
)
366 expr
= gimple_assign_rhs1 (stmt
);
367 else if (is_gimple_assign (stmt
))
369 tree_code code
= gimple_assign_rhs_code (stmt
);
370 if (code
== NOP_EXPR
)
372 tree rhs
= gimple_assign_rhs1 (stmt
);
373 if (POINTER_TYPE_P (TREE_TYPE (rhs
)))
374 expr
= gimple_assign_rhs1 (stmt
);
381 else if (code
== POINTER_PLUS_EXPR
)
383 expr
= gimple_assign_rhs1 (stmt
);
385 tree offset
= gimple_assign_rhs2 (stmt
);
386 extend_offset_range (offset
);
401 if (TREE_CODE (expr
) == ADDR_EXPR
)
402 expr
= TREE_OPERAND (expr
, 0);
404 /* Stash the reference for offset validation. */
407 poly_int64 bitsize
, bitpos
;
410 int sign
, reverse
, vol
;
412 /* Determine the base object or pointer of the reference and
413 the constant bit offset from the beginning of the base.
414 If the offset has a non-constant component, it will be in
415 VAR_OFF. MODE, SIGN, REVERSE, and VOL are write only and
417 base
= get_inner_reference (expr
, &bitsize
, &bitpos
, &var_off
,
418 &mode
, &sign
, &reverse
, &vol
);
420 /* get_inner_reference is not expected to return null. */
421 gcc_assert (base
!= NULL
);
423 poly_int64 bytepos
= exact_div (bitpos
, BITS_PER_UNIT
);
425 /* Convert the poly_int64 offset to offset_int. The offset
426 should be constant but be prepared for it not to be just in
429 if (bytepos
.is_constant (&cstoff
))
431 offrange
[0] += cstoff
;
432 offrange
[1] += cstoff
;
434 /* Besides the reference saved above, also stash the offset
436 if (TREE_CODE (expr
) == COMPONENT_REF
)
440 offrange
[1] += maxobjsize
;
444 if (TREE_CODE (var_off
) == INTEGER_CST
)
446 cstoff
= wi::to_offset (var_off
);
447 offrange
[0] += cstoff
;
448 offrange
[1] += cstoff
;
451 offrange
[1] += maxobjsize
;
454 if (TREE_CODE (base
) == MEM_REF
)
456 tree memrefoff
= TREE_OPERAND (base
, 1);
457 extend_offset_range (memrefoff
);
458 base
= TREE_OPERAND (base
, 0);
461 if (TREE_CODE (base
) == SSA_NAME
)
462 set_base_and_offset (base
);
465 /* Return error_mark_node if the signed offset exceeds the bounds
466 of the address space (PTRDIFF_MAX). Otherwise, return either
467 BASE or REF when the offset exceeds the bounds of the BASE or
468 REF object, and set OOBOFF to the past-the-end offset formed
469 by the reference, including its size. When STRICT is non-zero
470 use REF size, when available, otherwise use BASE size. When
471 STRICT is greater than 1, use the size of the last array member
472 as the bound, otherwise treat such a member as a flexible array
473 member. Return NULL when the offset is in bounds. */
476 builtin_memref::offset_out_of_bounds (int strict
, offset_int ooboff
[2]) const
478 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
480 /* A temporary, possibly adjusted, copy of the offset range. */
481 offset_int offrng
[2] = { offrange
[0], offrange
[1] };
483 if (DECL_P (base
) && TREE_CODE (TREE_TYPE (base
)) == ARRAY_TYPE
)
485 /* Check for offset in an anti-range with a negative lower bound.
486 For such a range, consider only the non-negative subrange. */
487 if (offrng
[1] < offrng
[0] && offrng
[1] < 0)
488 offrng
[1] = maxobjsize
;
491 /* Conservative offset of the last byte of the referenced object. */
494 /* The bounds need not be ordered. Set HIB to use as the index
495 of the larger of the bounds and LOB as the opposite. */
496 bool hib
= wi::les_p (offrng
[0], offrng
[1]);
501 endoff
= offrng
[lob
] + sizrange
[0];
503 /* For a reference through a pointer to an object of unknown size
504 all initial offsets are considered valid, positive as well as
505 negative, since the pointer itself can point past the beginning
506 of the object. However, the sum of the lower bound of the offset
507 and that of the size must be less than or equal than PTRDIFF_MAX. */
508 if (endoff
> maxobjsize
)
509 return error_mark_node
;
514 /* A reference to an object of known size must be within the bounds
515 of the base object. */
516 if (offrng
[hib
] < 0 || offrng
[lob
] > basesize
)
519 /* The extent of the reference must also be within the bounds of
520 the base object (if known) or the maximum object size otherwise. */
521 endoff
= wi::smax (offrng
[lob
], 0) + sizrange
[0];
522 if (endoff
> maxobjsize
)
523 return error_mark_node
;
525 offset_int size
= basesize
;
532 && TREE_CODE (ref
) == COMPONENT_REF
534 || !array_at_struct_end_p (ref
)))
536 /* If the reference is to a member subobject, the offset must
537 be within the bounds of the subobject. */
538 tree field
= TREE_OPERAND (ref
, 1);
539 tree type
= TREE_TYPE (field
);
540 if (tree sz
= TYPE_SIZE_UNIT (type
))
541 if (TREE_CODE (sz
) == INTEGER_CST
)
543 size
= refoff
+ wi::to_offset (sz
);
551 /* Set the out-of-bounds offset range to be one greater than
552 that delimited by the reference including its size. */
553 ooboff
[lob
] = size
+ 1;
555 if (endoff
> ooboff
[lob
])
556 ooboff
[hib
] = endoff
;
558 ooboff
[hib
] = wi::smax (offrng
[lob
], 0) + sizrange
[1];
563 /* Create an association between the memory references DST and SRC
564 for access by a call EXPR to a memory or string built-in funtion. */
566 builtin_access::builtin_access (gcall
*call
, builtin_memref
&dst
,
568 : dstref (&dst
), srcref (&src
), sizrange (), ovloff (), ovlsiz (),
569 dstoff (), srcoff (), dstsiz (), srcsiz ()
571 /* Zero out since the offset_int ctors invoked above are no-op. */
572 dstoff
[0] = dstoff
[1] = 0;
573 srcoff
[0] = srcoff
[1] = 0;
574 dstsiz
[0] = dstsiz
[1] = 0;
575 srcsiz
[0] = srcsiz
[1] = 0;
577 /* Object Size Type to use to determine the size of the destination
578 and source objects. Overridden below for raw memory functions. */
581 /* True when the size of one reference depends on the offset of
582 itself or the other. */
583 bool depends_p
= true;
585 /* True when the size of the destination reference DSTREF has been
586 determined from SRCREF and so needs to be adjusted by the latter's
587 offset. Only meaningful for bounded string functions like strncpy. */
588 bool dstadjust_p
= false;
590 /* The size argument number (depends on the built-in). */
591 unsigned sizeargno
= 2;
593 tree func
= gimple_call_fndecl (call
);
594 switch (DECL_FUNCTION_CODE (func
))
596 case BUILT_IN_MEMCPY
:
597 case BUILT_IN_MEMCPY_CHK
:
598 case BUILT_IN_MEMPCPY
:
599 case BUILT_IN_MEMPCPY_CHK
:
602 detect_overlap
= &builtin_access::generic_overlap
;
605 case BUILT_IN_MEMMOVE
:
606 case BUILT_IN_MEMMOVE_CHK
:
607 /* For memmove there is never any overlap to check for. */
610 detect_overlap
= &builtin_access::no_overlap
;
613 case BUILT_IN_STPNCPY
:
614 case BUILT_IN_STPNCPY_CHK
:
615 case BUILT_IN_STRNCPY
:
616 case BUILT_IN_STRNCPY_CHK
:
617 dstref
->strbounded_p
= true;
618 detect_overlap
= &builtin_access::strcpy_overlap
;
621 case BUILT_IN_STPCPY
:
622 case BUILT_IN_STPCPY_CHK
:
623 case BUILT_IN_STRCPY
:
624 case BUILT_IN_STRCPY_CHK
:
625 detect_overlap
= &builtin_access::strcpy_overlap
;
628 case BUILT_IN_STRCAT
:
629 case BUILT_IN_STRCAT_CHK
:
630 detect_overlap
= &builtin_access::strcat_overlap
;
633 case BUILT_IN_STRNCAT
:
634 case BUILT_IN_STRNCAT_CHK
:
635 dstref
->strbounded_p
= true;
636 srcref
->strbounded_p
= true;
637 detect_overlap
= &builtin_access::strcat_overlap
;
641 /* Handle other string functions here whose access may need
642 to be validated for in-bounds offsets and non-overlapping
647 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
649 /* Try to determine the size of the base object. compute_objsize
650 expects a pointer so create one if BASE is a non-pointer object. */
652 if (dst
.basesize
< 0)
655 if (!POINTER_TYPE_P (TREE_TYPE (addr
)))
656 addr
= build1 (ADDR_EXPR
, (TREE_TYPE (addr
)), addr
);
658 if (tree dstsize
= compute_objsize (addr
, ostype
))
659 dst
.basesize
= wi::to_offset (dstsize
);
660 else if (POINTER_TYPE_P (TREE_TYPE (addr
)))
661 dst
.basesize
= HOST_WIDE_INT_MIN
;
663 dst
.basesize
= maxobjsize
;
666 if (src
.basesize
< 0)
669 if (!POINTER_TYPE_P (TREE_TYPE (addr
)))
670 addr
= build1 (ADDR_EXPR
, (TREE_TYPE (addr
)), addr
);
672 if (tree srcsize
= compute_objsize (addr
, ostype
))
673 src
.basesize
= wi::to_offset (srcsize
);
674 else if (POINTER_TYPE_P (TREE_TYPE (addr
)))
675 src
.basesize
= HOST_WIDE_INT_MIN
;
677 src
.basesize
= maxobjsize
;
680 /* If there is no dependency between the references or the base
681 objects of the two references aren't the same there's nothing
683 if (depends_p
&& dstref
->base
!= srcref
->base
)
686 /* ...otherwise, make adjustments for references to the same object
687 by string built-in functions to reflect the constraints imposed
690 /* For bounded string functions determine the range of the bound
691 on the access. For others, the range stays unbounded. */
692 offset_int bounds
[2] = { maxobjsize
, maxobjsize
};
693 if (dstref
->strbounded_p
)
695 tree size
= gimple_call_arg (call
, sizeargno
);
697 if (get_size_range (size
, range
, true))
699 bounds
[0] = wi::to_offset (range
[0]);
700 bounds
[1] = wi::to_offset (range
[1]);
703 /* If both references' size ranges are indeterminate use the last
704 (size) argument from the function call as a substitute. This
705 may only be necessary for strncpy (but not for memcpy where
706 the size range would have been already determined this way). */
707 if (dstref
->sizrange
[0] == 0 && dstref
->sizrange
[1] == maxobjsize
708 && srcref
->sizrange
[0] == 0 && srcref
->sizrange
[1] == maxobjsize
)
710 dstref
->sizrange
[0] = bounds
[0];
711 dstref
->sizrange
[1] = bounds
[1];
715 /* The size range of one reference involving the same base object
716 can be determined from the size range of the other reference.
717 This makes it possible to compute accurate offsets for warnings
718 involving functions like strcpy where the length of just one of
719 the two arguments is known (determined by tree-ssa-strlen). */
720 if (dstref
->sizrange
[0] == 0 && dstref
->sizrange
[1] == maxobjsize
)
722 /* When the destination size is unknown set it to the size of
724 dstref
->sizrange
[0] = srcref
->sizrange
[0];
725 dstref
->sizrange
[1] = srcref
->sizrange
[1];
727 else if (srcref
->sizrange
[0] == 0 && srcref
->sizrange
[1] == maxobjsize
)
729 /* When the source size is unknown set it to the size of
731 srcref
->sizrange
[0] = dstref
->sizrange
[0];
732 srcref
->sizrange
[1] = dstref
->sizrange
[1];
736 if (dstref
->strbounded_p
)
738 /* Read access by strncpy is bounded. */
739 if (bounds
[0] < srcref
->sizrange
[0])
740 srcref
->sizrange
[0] = bounds
[0];
741 if (bounds
[1] < srcref
->sizrange
[1])
742 srcref
->sizrange
[1] = bounds
[1];
745 /* For string functions, adjust the size range of the source
746 reference by the inverse boundaries of the offset (because
747 the higher the offset into the string the shorter its
749 if (srcref
->offrange
[1] >= 0
750 && srcref
->offrange
[1] < srcref
->sizrange
[0])
751 srcref
->sizrange
[0] -= srcref
->offrange
[1];
753 srcref
->sizrange
[0] = 0;
755 if (srcref
->offrange
[0] > 0)
757 if (srcref
->offrange
[0] < srcref
->sizrange
[1])
758 srcref
->sizrange
[1] -= srcref
->offrange
[0];
760 srcref
->sizrange
[1] = 0;
767 if (detect_overlap
== &builtin_access::generic_overlap
)
769 if (dstref
->strbounded_p
)
771 dstref
->sizrange
[0] = bounds
[0];
772 dstref
->sizrange
[1] = bounds
[1];
774 if (dstref
->sizrange
[0] < srcref
->sizrange
[0])
775 srcref
->sizrange
[0] = dstref
->sizrange
[0];
777 if (dstref
->sizrange
[1] < srcref
->sizrange
[1])
778 srcref
->sizrange
[1] = dstref
->sizrange
[1];
781 else if (detect_overlap
== &builtin_access::strcpy_overlap
)
783 if (!dstref
->strbounded_p
)
785 /* For strcpy, adjust the destination size range to match that
786 of the source computed above. */
787 if (depends_p
&& dstadjust_p
)
789 dstref
->sizrange
[0] = srcref
->sizrange
[0];
790 dstref
->sizrange
[1] = srcref
->sizrange
[1];
795 if (dstref
->strbounded_p
)
797 /* For strncpy, adjust the destination size range to match that
798 of the source computed above. */
799 dstref
->sizrange
[0] = bounds
[0];
800 dstref
->sizrange
[1] = bounds
[1];
802 if (bounds
[0] < srcref
->sizrange
[0])
803 srcref
->sizrange
[0] = bounds
[0];
805 if (bounds
[1] < srcref
->sizrange
[1])
806 srcref
->sizrange
[1] = bounds
[1];
811 builtin_access::overlap_size (const offset_int a
[2], const offset_int b
[2],
814 const offset_int
*p
= a
;
815 const offset_int
*q
= b
;
817 /* Point P at the bigger of the two ranges and Q at the smaller. */
818 if (wi::lts_p (a
[1] - a
[0], b
[1] - b
[0]))
830 return wi::smin (p
[1], q
[1]) - q
[0];
840 /* Return true if the bounded mempry (memcpy amd similar) or string function
841 access (strncpy and similar) ACS overlaps. */
844 builtin_access::generic_overlap ()
846 builtin_access
&acs
= *this;
847 const builtin_memref
*dstref
= acs
.dstref
;
848 const builtin_memref
*srcref
= acs
.srcref
;
850 gcc_assert (dstref
->base
== srcref
->base
);
852 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
854 offset_int maxsize
= dstref
->basesize
< 0 ? maxobjsize
: dstref
->basesize
;
855 gcc_assert (maxsize
<= maxobjsize
);
857 /* Adjust the larger bounds of the offsets (which may be the first
858 element if the lower bound is larger than the upper bound) to
859 make them valid for the smallest access (if possible) but no smaller
860 than the smaller bounds. */
861 gcc_assert (wi::les_p (acs
.dstoff
[0], acs
.dstoff
[1]));
863 if (maxsize
< acs
.dstoff
[1] + acs
.dstsiz
[0])
864 acs
.dstoff
[1] = maxsize
- acs
.dstsiz
[0];
865 if (acs
.dstoff
[1] < acs
.dstoff
[0])
866 acs
.dstoff
[1] = acs
.dstoff
[0];
868 gcc_assert (wi::les_p (acs
.srcoff
[0], acs
.srcoff
[1]));
870 if (maxsize
< acs
.srcoff
[1] + acs
.srcsiz
[0])
871 acs
.srcoff
[1] = maxsize
- acs
.srcsiz
[0];
872 if (acs
.srcoff
[1] < acs
.srcoff
[0])
873 acs
.srcoff
[1] = acs
.srcoff
[0];
875 /* Determine the minimum and maximum space for the access given
878 space
[0] = wi::abs (acs
.dstoff
[0] - acs
.srcoff
[0]);
881 offset_int d
= wi::abs (acs
.dstoff
[0] - acs
.srcoff
[1]);
882 if (acs
.srcsiz
[0] > 0)
891 space
[1] = acs
.dstsiz
[1];
893 d
= wi::abs (acs
.dstoff
[1] - acs
.srcoff
[0]);
900 /* Treat raw memory functions both of whose references are bounded
901 as special and permit uncertain overlaps to go undetected. For
902 all kinds of constant offset and constant size accesses, if
903 overlap isn't certain it is not possible. */
904 bool overlap_possible
= space
[0] < acs
.dstsiz
[1];
905 if (!overlap_possible
)
908 bool overlap_certain
= space
[1] < acs
.dstsiz
[0];
910 /* True when the size of one reference depends on the offset of
912 bool depends_p
= detect_overlap
!= &builtin_access::generic_overlap
;
914 if (!overlap_certain
)
916 if (!dstref
->strbounded_p
&& !depends_p
)
917 /* Memcpy only considers certain overlap. */
920 /* There's no way to distinguish an access to the same member
921 of a structure from one to two distinct members of the same
922 structure. Give up to avoid excessive false positives. */
923 tree basetype
= TREE_TYPE (dstref
->base
);
925 if (POINTER_TYPE_P (basetype
))
926 basetype
= TREE_TYPE (basetype
);
928 while (TREE_CODE (basetype
) == ARRAY_TYPE
)
929 basetype
= TREE_TYPE (basetype
);
931 if (RECORD_OR_UNION_TYPE_P (basetype
))
935 /* True for stpcpy and strcpy. */
936 bool stxcpy_p
= (!dstref
->strbounded_p
937 && detect_overlap
== &builtin_access::strcpy_overlap
);
939 if (dstref
->refoff
>= 0
940 && srcref
->refoff
>= 0
941 && dstref
->refoff
!= srcref
->refoff
942 && (stxcpy_p
|| dstref
->strbounded_p
|| srcref
->strbounded_p
))
945 offset_int siz
[2] = { maxobjsize
+ 1, 0 };
947 ovloff
[0] = HOST_WIDE_INT_MAX
;
948 ovloff
[1] = HOST_WIDE_INT_MIN
;
950 /* Adjustment to the lower bound of the offset of the overlap to
951 account for a subset of unbounded string calls where the size
952 of the destination string depends on the length of the source
953 which in turn depends on the offset into it. */
958 sub1
= acs
.dstoff
[0] <= acs
.srcoff
[0];
960 /* Iterate over the extreme locations (on the horizontal axis formed
961 by their offsets) and sizes of two regions and find their smallest
962 and largest overlap and the corresponding offsets. */
963 for (unsigned i
= 0; i
!= 2; ++i
)
965 const offset_int a
[2] = {
966 acs
.dstoff
[i
], acs
.dstoff
[i
] + acs
.dstsiz
[!i
]
969 const offset_int b
[2] = {
970 acs
.srcoff
[i
], acs
.srcoff
[i
] + acs
.srcsiz
[!i
]
974 offset_int sz
= overlap_size (a
, b
, &off
);
983 if (wi::lts_p (off
, ovloff
[0]))
984 ovloff
[0] = off
.to_shwi ();
985 if (wi::lts_p (ovloff
[1], off
))
986 ovloff
[1] = off
.to_shwi ();
994 /* Iterate over the extreme locations (on the horizontal axis
995 formed by their offsets) and sizes of two regions and find
996 their smallest and largest overlap and the corresponding
999 for (unsigned io
= 0; io
!= 2; ++io
)
1000 for (unsigned is
= 0; is
!= 2; ++is
)
1002 const offset_int a
[2] = {
1003 acs
.dstoff
[io
], acs
.dstoff
[io
] + acs
.dstsiz
[is
]
1006 for (unsigned jo
= 0; jo
!= 2; ++jo
)
1007 for (unsigned js
= 0; js
!= 2; ++js
)
1011 /* For st{p,r}ncpy the size of the source sequence
1012 depends on the offset into it. */
1018 const offset_int b
[2] = {
1019 acs
.srcoff
[jo
], acs
.srcoff
[jo
] + acs
.srcsiz
[js
]
1023 offset_int sz
= overlap_size (a
, b
, &off
);
1032 if (wi::lts_p (off
, ovloff
[0]))
1033 ovloff
[0] = off
.to_shwi ();
1034 if (wi::lts_p (ovloff
[1], off
))
1035 ovloff
[1] = off
.to_shwi ();
1041 ovlsiz
[0] = siz
[0].to_shwi ();
1042 ovlsiz
[1] = siz
[1].to_shwi ();
1044 if (ovlsiz
[0] == 0 && ovlsiz
[1] > 1)
1045 ovloff
[0] = ovloff
[1] + ovlsiz
[1] - 1 - sub1
;
1050 /* Return true if the strcat-like access overlaps. */
1053 builtin_access::strcat_overlap ()
1055 builtin_access
&acs
= *this;
1056 const builtin_memref
*dstref
= acs
.dstref
;
1057 const builtin_memref
*srcref
= acs
.srcref
;
1059 gcc_assert (dstref
->base
== srcref
->base
);
1061 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
1063 gcc_assert (dstref
->base
&& dstref
->base
== srcref
->base
);
1065 /* Adjust for strcat-like accesses. */
1067 /* As a special case for strcat, set the DSTREF offsets to the length
1068 of the source string since the function starts writing at the first
1069 nul, and set the size to 1 for the length of the nul. */
1070 acs
.dstoff
[0] += acs
.dstsiz
[0];
1071 acs
.dstoff
[1] += acs
.dstsiz
[1];
1073 bool strfunc_unknown_args
= acs
.dstsiz
[0] == 0 && acs
.dstsiz
[1] != 0;
1075 /* The lower bound is zero when the size is unknown because then
1076 overlap is not certain. */
1077 acs
.dstsiz
[0] = strfunc_unknown_args
? 0 : 1;
1080 offset_int maxsize
= dstref
->basesize
< 0 ? maxobjsize
: dstref
->basesize
;
1081 gcc_assert (maxsize
<= maxobjsize
);
1083 /* For references to the same base object, determine if there's a pair
1084 of valid offsets into the two references such that access between
1085 them doesn't overlap. Adjust both upper bounds to be valid for
1086 the smaller size (i.e., at most MAXSIZE - SIZE). */
1088 if (maxsize
< acs
.dstoff
[1] + acs
.dstsiz
[0])
1089 acs
.dstoff
[1] = maxsize
- acs
.dstsiz
[0];
1091 if (maxsize
< acs
.srcoff
[1] + acs
.srcsiz
[0])
1092 acs
.srcoff
[1] = maxsize
- acs
.srcsiz
[0];
1094 /* Check to see if there's enough space for both accesses without
1095 overlap. Determine the optimistic (maximum) amount of available
1098 if (acs
.dstoff
[0] <= acs
.srcoff
[0])
1100 if (acs
.dstoff
[1] < acs
.srcoff
[1])
1101 space
= acs
.srcoff
[1] + acs
.srcsiz
[0] - acs
.dstoff
[0];
1103 space
= acs
.dstoff
[1] + acs
.dstsiz
[0] - acs
.srcoff
[0];
1106 space
= acs
.dstoff
[1] + acs
.dstsiz
[0] - acs
.srcoff
[0];
1108 /* Overlap is certain if the distance between the farthest offsets
1109 of the opposite accesses is less than the sum of the lower bounds
1110 of the sizes of the two accesses. */
1111 bool overlap_certain
= space
< acs
.dstsiz
[0] + acs
.srcsiz
[0];
1113 /* For a constant-offset, constant size access, consider the largest
1114 distance between the offset bounds and the lower bound of the access
1115 size. If the overlap isn't certain return success. */
1116 if (!overlap_certain
1117 && acs
.dstoff
[0] == acs
.dstoff
[1]
1118 && acs
.srcoff
[0] == acs
.srcoff
[1]
1119 && acs
.dstsiz
[0] == acs
.dstsiz
[1]
1120 && acs
.srcsiz
[0] == acs
.srcsiz
[1])
1123 /* Overlap is not certain but may be possible. */
1125 offset_int access_min
= acs
.dstsiz
[0] + acs
.srcsiz
[0];
1127 /* Determine the conservative (minimum) amount of space. */
1128 space
= wi::abs (acs
.dstoff
[0] - acs
.srcoff
[0]);
1129 offset_int d
= wi::abs (acs
.dstoff
[0] - acs
.srcoff
[1]);
1132 d
= wi::abs (acs
.dstoff
[1] - acs
.srcoff
[0]);
1136 /* For a strict test (used for strcpy and similar with unknown or
1137 variable bounds or sizes), consider the smallest distance between
1138 the offset bounds and either the upper bound of the access size
1139 if known, or the lower bound otherwise. */
1140 if (access_min
<= space
&& (access_min
!= 0 || !strfunc_unknown_args
))
1143 /* When strcat overlap is certain it is always a single byte:
1144 the terminating NUL, regardless of offsets and sizes. When
1145 overlap is only possible its range is [0, 1]. */
1146 acs
.ovlsiz
[0] = dstref
->sizrange
[0] == dstref
->sizrange
[1] ? 1 : 0;
1149 offset_int endoff
= dstref
->offrange
[0] + dstref
->sizrange
[0];
1150 if (endoff
<= srcref
->offrange
[0])
1151 acs
.ovloff
[0] = wi::smin (maxobjsize
, srcref
->offrange
[0]).to_shwi ();
1153 acs
.ovloff
[0] = wi::smin (maxobjsize
, endoff
).to_shwi ();
1155 acs
.sizrange
[0] = wi::smax (wi::abs (endoff
- srcref
->offrange
[0]) + 1,
1156 srcref
->sizrange
[0]).to_shwi ();
1157 if (dstref
->offrange
[0] == dstref
->offrange
[1])
1159 if (srcref
->offrange
[0] == srcref
->offrange
[1])
1160 acs
.ovloff
[1] = acs
.ovloff
[0];
1163 = wi::smin (maxobjsize
,
1164 srcref
->offrange
[1] + srcref
->sizrange
[1]).to_shwi ();
1168 = wi::smin (maxobjsize
,
1169 dstref
->offrange
[1] + dstref
->sizrange
[1]).to_shwi ();
1171 if (acs
.sizrange
[0] == 0)
1172 acs
.sizrange
[0] = 1;
1173 acs
.sizrange
[1] = wi::smax (acs
.dstsiz
[1], srcref
->sizrange
[1]).to_shwi ();
1177 /* Return true if the strcpy-like access overlaps. */
1180 builtin_access::strcpy_overlap ()
1182 return generic_overlap ();
1186 /* Return true if DSTREF and SRCREF describe accesses that either overlap
1187 one another or that, in order not to overlap, would imply that the size
1188 of the referenced object(s) exceeds the maximum size of an object. Set
1189 Otherwise, if DSTREF and SRCREF do not definitely overlap (even though
1190 they may overlap in a way that's not apparent from the available data),
1194 builtin_access::overlap ()
1196 builtin_access
&acs
= *this;
1198 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
1200 acs
.sizrange
[0] = wi::smax (dstref
->sizrange
[0],
1201 srcref
->sizrange
[0]).to_shwi ();
1202 acs
.sizrange
[1] = wi::smax (dstref
->sizrange
[1],
1203 srcref
->sizrange
[1]).to_shwi ();
1205 /* Check to see if the two references refer to regions that are
1206 too large not to overlap in the address space (whose maximum
1207 size is PTRDIFF_MAX). */
1208 offset_int size
= dstref
->sizrange
[0] + srcref
->sizrange
[0];
1209 if (maxobjsize
< size
)
1211 acs
.ovloff
[0] = (maxobjsize
- dstref
->sizrange
[0]).to_shwi ();
1212 acs
.ovlsiz
[0] = (size
- maxobjsize
).to_shwi ();
1216 /* If both base objects aren't known return the maximum possible
1217 offset that would make them not overlap. */
1218 if (!dstref
->base
|| !srcref
->base
)
1221 /* Set the access offsets. */
1222 acs
.dstoff
[0] = dstref
->offrange
[0];
1223 acs
.dstoff
[1] = dstref
->offrange
[1];
1225 /* If the base object is an array adjust the bounds of the offset
1226 to be non-negative and within the bounds of the array if possible. */
1228 && TREE_CODE (TREE_TYPE (dstref
->base
)) == ARRAY_TYPE
)
1230 if (acs
.dstoff
[0] < 0 && acs
.dstoff
[1] >= 0)
1233 if (acs
.dstoff
[1] < acs
.dstoff
[0])
1235 if (tree size
= TYPE_SIZE_UNIT (TREE_TYPE (dstref
->base
)))
1236 acs
.dstoff
[1] = wi::umin (acs
.dstoff
[1], wi::to_offset (size
));
1238 acs
.dstoff
[1] = wi::umin (acs
.dstoff
[1], maxobjsize
);
1242 acs
.srcoff
[0] = srcref
->offrange
[0];
1243 acs
.srcoff
[1] = srcref
->offrange
[1];
1246 && TREE_CODE (TREE_TYPE (srcref
->base
)) == ARRAY_TYPE
)
1248 if (acs
.srcoff
[0] < 0 && acs
.srcoff
[1] >= 0)
1251 if (tree size
= TYPE_SIZE_UNIT (TREE_TYPE (srcref
->base
)))
1252 acs
.srcoff
[1] = wi::umin (acs
.srcoff
[1], wi::to_offset (size
));
1253 else if (acs
.srcoff
[1] < acs
.srcoff
[0])
1254 acs
.srcoff
[1] = wi::umin (acs
.srcoff
[1], maxobjsize
);
1257 /* When the upper bound of the offset is less than the lower bound
1258 the former is the result of a negative offset being represented
1259 as a large positive value or vice versa. The resulting range is
1260 a union of two subranges: [MIN, UB] and [LB, MAX]. Since such
1261 a union is not representable using the current data structure
1262 replace it with the full range of offsets. */
1263 if (acs
.dstoff
[1] < acs
.dstoff
[0])
1265 acs
.dstoff
[0] = -maxobjsize
- 1;
1266 acs
.dstoff
[1] = maxobjsize
;
1269 /* Validate the offset and size of each reference on its own first.
1270 This is independent of whether or not the base objects are the
1271 same. Normally, this would have already been detected and
1272 diagnosed by -Warray-bounds, unless it has been disabled. */
1273 offset_int maxoff
= acs
.dstoff
[0] + dstref
->sizrange
[0];
1274 if (maxobjsize
< maxoff
)
1276 acs
.ovlsiz
[0] = (maxoff
- maxobjsize
).to_shwi ();
1277 acs
.ovloff
[0] = acs
.dstoff
[0].to_shwi () - acs
.ovlsiz
[0];
1281 /* Repeat the same as above but for the source offsets. */
1282 if (acs
.srcoff
[1] < acs
.srcoff
[0])
1284 acs
.srcoff
[0] = -maxobjsize
- 1;
1285 acs
.srcoff
[1] = maxobjsize
;
1288 maxoff
= acs
.srcoff
[0] + srcref
->sizrange
[0];
1289 if (maxobjsize
< maxoff
)
1291 acs
.ovlsiz
[0] = (maxoff
- maxobjsize
).to_shwi ();
1292 acs
.ovlsiz
[1] = (acs
.srcoff
[0] + srcref
->sizrange
[1]
1293 - maxobjsize
).to_shwi ();
1294 acs
.ovloff
[0] = acs
.srcoff
[0].to_shwi () - acs
.ovlsiz
[0];
1298 if (dstref
->base
!= srcref
->base
)
1301 acs
.dstsiz
[0] = dstref
->sizrange
[0];
1302 acs
.dstsiz
[1] = dstref
->sizrange
[1];
1304 acs
.srcsiz
[0] = srcref
->sizrange
[0];
1305 acs
.srcsiz
[1] = srcref
->sizrange
[1];
1307 /* Call the appropriate function to determine the overlap. */
1308 if ((this->*detect_overlap
) ())
1312 /* Unless the access size range has already been set, do so here. */
1313 sizrange
[0] = wi::smax (acs
.dstsiz
[0], srcref
->sizrange
[0]).to_shwi ();
1314 sizrange
[1] = wi::smax (acs
.dstsiz
[1], srcref
->sizrange
[1]).to_shwi ();
1322 /* Attempt to detect and diagnose an overlapping copy in a call expression
1323 EXPR involving an an access ACS to a built-in memory or string function.
1324 Return true when one has been detected, false otherwise. */
1327 maybe_diag_overlap (location_t loc
, gcall
*call
, builtin_access
&acs
)
1329 if (!acs
.overlap ())
1332 /* For convenience. */
1333 const builtin_memref
&dstref
= *acs
.dstref
;
1334 const builtin_memref
&srcref
= *acs
.srcref
;
1336 /* Determine the range of offsets and sizes of the overlap if it
1337 exists and issue diagnostics. */
1338 HOST_WIDE_INT
*ovloff
= acs
.ovloff
;
1339 HOST_WIDE_INT
*ovlsiz
= acs
.ovlsiz
;
1340 HOST_WIDE_INT
*sizrange
= acs
.sizrange
;
1342 tree func
= gimple_call_fndecl (call
);
1344 /* To avoid a combinatorial explosion of diagnostics format the offsets
1345 or their ranges as strings and use them in the warning calls below. */
1348 if (dstref
.offrange
[0] == dstref
.offrange
[1]
1349 || dstref
.offrange
[1] > HOST_WIDE_INT_MAX
)
1350 sprintf (offstr
[0], HOST_WIDE_INT_PRINT_DEC
,
1351 dstref
.offrange
[0].to_shwi ());
1354 "[" HOST_WIDE_INT_PRINT_DEC
", " HOST_WIDE_INT_PRINT_DEC
"]",
1355 dstref
.offrange
[0].to_shwi (),
1356 dstref
.offrange
[1].to_shwi ());
1358 if (srcref
.offrange
[0] == srcref
.offrange
[1]
1359 || srcref
.offrange
[1] > HOST_WIDE_INT_MAX
)
1361 HOST_WIDE_INT_PRINT_DEC
,
1362 srcref
.offrange
[0].to_shwi ());
1365 "[" HOST_WIDE_INT_PRINT_DEC
", " HOST_WIDE_INT_PRINT_DEC
"]",
1366 srcref
.offrange
[0].to_shwi (),
1367 srcref
.offrange
[1].to_shwi ());
1369 if (ovloff
[0] == ovloff
[1] || !ovloff
[1])
1370 sprintf (offstr
[2], HOST_WIDE_INT_PRINT_DEC
, ovloff
[0]);
1373 "[" HOST_WIDE_INT_PRINT_DEC
", " HOST_WIDE_INT_PRINT_DEC
"]",
1374 ovloff
[0], ovloff
[1]);
1376 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
1377 bool must_overlap
= ovlsiz
[0] > 0;
1380 ovlsiz
[1] = ovlsiz
[0];
1384 /* Issue definitive "overlaps" diagnostic in this block. */
1386 if (sizrange
[0] == sizrange
[1])
1388 if (ovlsiz
[0] == ovlsiz
[1])
1389 warning_at (loc
, OPT_Wrestrict
,
1392 ? G_("%G%qD accessing %wu byte at offsets %s "
1393 "and %s overlaps %wu byte at offset %s")
1394 : G_("%G%qD accessing %wu byte at offsets %s "
1395 "and %s overlaps %wu bytes at offset "
1398 ? G_("%G%qD accessing %wu bytes at offsets %s "
1399 "and %s overlaps %wu byte at offset %s")
1400 : G_("%G%qD accessing %wu bytes at offsets %s "
1401 "and %s overlaps %wu bytes at offset "
1403 call
, func
, sizrange
[0],
1404 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1405 else if (ovlsiz
[1] >= 0 && ovlsiz
[1] < maxobjsize
.to_shwi ())
1406 warning_n (loc
, OPT_Wrestrict
, sizrange
[0],
1407 "%G%qD accessing %wu byte at offsets %s "
1408 "and %s overlaps between %wu and %wu bytes "
1410 "%G%qD accessing %wu bytes at offsets %s "
1411 "and %s overlaps between %wu and %wu bytes "
1413 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1414 ovlsiz
[0], ovlsiz
[1], offstr
[2]);
1416 warning_n (loc
, OPT_Wrestrict
, sizrange
[0],
1417 "%G%qD accessing %wu byte at offsets %s and "
1418 "%s overlaps %wu or more bytes at offset %s",
1419 "%G%qD accessing %wu bytes at offsets %s and "
1420 "%s overlaps %wu or more bytes at offset %s",
1421 call
, func
, sizrange
[0],
1422 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1426 if (sizrange
[1] >= 0 && sizrange
[1] < maxobjsize
.to_shwi ())
1428 if (ovlsiz
[0] == ovlsiz
[1])
1429 warning_n (loc
, OPT_Wrestrict
, ovlsiz
[0],
1430 "%G%qD accessing between %wu and %wu bytes "
1431 "at offsets %s and %s overlaps %wu byte at "
1433 "%G%qD accessing between %wu and %wu bytes "
1434 "at offsets %s and %s overlaps %wu bytes "
1436 call
, func
, sizrange
[0], sizrange
[1],
1437 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1438 else if (ovlsiz
[1] >= 0 && ovlsiz
[1] < maxobjsize
.to_shwi ())
1439 warning_at (loc
, OPT_Wrestrict
,
1440 "%G%qD accessing between %wu and %wu bytes at "
1441 "offsets %s and %s overlaps between %wu and %wu "
1442 "bytes at offset %s",
1443 call
, func
, sizrange
[0], sizrange
[1],
1444 offstr
[0], offstr
[1], ovlsiz
[0], ovlsiz
[1],
1447 warning_at (loc
, OPT_Wrestrict
,
1448 "%G%qD accessing between %wu and %wu bytes at "
1449 "offsets %s and %s overlaps %wu or more bytes "
1451 call
, func
, sizrange
[0], sizrange
[1],
1452 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1456 if (ovlsiz
[0] != ovlsiz
[1])
1457 ovlsiz
[1] = maxobjsize
.to_shwi ();
1459 if (ovlsiz
[0] == ovlsiz
[1])
1460 warning_n (loc
, OPT_Wrestrict
, ovlsiz
[0],
1461 "%G%qD accessing %wu or more bytes at offsets "
1462 "%s and %s overlaps %wu byte at offset %s",
1463 "%G%qD accessing %wu or more bytes at offsets "
1464 "%s and %s overlaps %wu bytes at offset %s",
1465 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1466 ovlsiz
[0], offstr
[2]);
1467 else if (ovlsiz
[1] >= 0 && ovlsiz
[1] < maxobjsize
.to_shwi ())
1468 warning_at (loc
, OPT_Wrestrict
,
1469 "%G%qD accessing %wu or more bytes at offsets %s "
1470 "and %s overlaps between %wu and %wu bytes "
1472 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1473 ovlsiz
[0], ovlsiz
[1], offstr
[2]);
1475 warning_at (loc
, OPT_Wrestrict
,
1476 "%G%qD accessing %wu or more bytes at offsets %s "
1477 "and %s overlaps %wu or more bytes at offset %s",
1478 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1479 ovlsiz
[0], offstr
[2]);
1483 /* Use more concise wording when one of the offsets is unbounded
1484 to avoid confusing the user with large and mostly meaningless
1487 if (DECL_P (dstref
.base
) && TREE_CODE (TREE_TYPE (dstref
.base
)) == ARRAY_TYPE
)
1488 open_range
= ((dstref
.offrange
[0] == 0
1489 && dstref
.offrange
[1] == maxobjsize
)
1490 || (srcref
.offrange
[0] == 0
1491 && srcref
.offrange
[1] == maxobjsize
));
1493 open_range
= ((dstref
.offrange
[0] == -maxobjsize
- 1
1494 && dstref
.offrange
[1] == maxobjsize
)
1495 || (srcref
.offrange
[0] == -maxobjsize
- 1
1496 && srcref
.offrange
[1] == maxobjsize
));
1498 if (sizrange
[0] == sizrange
[1] || sizrange
[1] == 1)
1503 warning_n (loc
, OPT_Wrestrict
, sizrange
[1],
1504 "%G%qD accessing %wu byte may overlap "
1506 "%G%qD accessing %wu bytes may overlap "
1508 call
, func
, sizrange
[1], ovlsiz
[1]);
1510 warning_n (loc
, OPT_Wrestrict
, sizrange
[1],
1511 "%G%qD accessing %wu byte at offsets %s "
1512 "and %s may overlap %wu byte at offset %s",
1513 "%G%qD accessing %wu bytes at offsets %s "
1514 "and %s may overlap %wu byte at offset %s",
1515 call
, func
, sizrange
[1], offstr
[0], offstr
[1],
1516 ovlsiz
[1], offstr
[2]);
1521 warning_n (loc
, OPT_Wrestrict
, sizrange
[1],
1522 "%G%qD accessing %wu byte may overlap "
1524 "%G%qD accessing %wu bytes may overlap "
1526 call
, func
, sizrange
[1], ovlsiz
[1]);
1528 warning_n (loc
, OPT_Wrestrict
, sizrange
[1],
1529 "%G%qD accessing %wu byte at offsets %s and "
1530 "%s may overlap up to %wu bytes at offset %s",
1531 "%G%qD accessing %wu bytes at offsets %s and "
1532 "%s may overlap up to %wu bytes at offset %s",
1533 call
, func
, sizrange
[1], offstr
[0], offstr
[1],
1534 ovlsiz
[1], offstr
[2]);
1538 if (sizrange
[1] >= 0 && sizrange
[1] < maxobjsize
.to_shwi ())
1541 warning_n (loc
, OPT_Wrestrict
, ovlsiz
[1],
1542 "%G%qD accessing between %wu and %wu bytes "
1543 "may overlap %wu byte",
1544 "%G%qD accessing between %wu and %wu bytes "
1545 "may overlap up to %wu bytes",
1546 call
, func
, sizrange
[0], sizrange
[1], ovlsiz
[1]);
1548 warning_n (loc
, OPT_Wrestrict
, ovlsiz
[1],
1549 "%G%qD accessing between %wu and %wu bytes "
1550 "at offsets %s and %s may overlap %wu byte "
1552 "%G%qD accessing between %wu and %wu bytes "
1553 "at offsets %s and %s may overlap up to %wu "
1554 "bytes at offset %s",
1555 call
, func
, sizrange
[0], sizrange
[1],
1556 offstr
[0], offstr
[1], ovlsiz
[1], offstr
[2]);
1560 warning_n (loc
, OPT_Wrestrict
, ovlsiz
[1],
1561 "%G%qD accessing %wu or more bytes at offsets %s "
1562 "and %s may overlap %wu byte at offset %s",
1563 "%G%qD accessing %wu or more bytes at offsets %s "
1564 "and %s may overlap up to %wu bytes at offset %s",
1565 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1566 ovlsiz
[1], offstr
[2]);
1571 /* Validate REF offsets in an EXPRession passed as an argument to a CALL
1572 to a built-in function FUNC to make sure they are within the bounds
1573 of the referenced object if its size is known, or PTRDIFF_MAX otherwise.
1574 Both initial values of the offsets and their final value computed by
1575 the function by incrementing the initial value by the size are
1576 validated. Return true if the offsets are not valid and a diagnostic
1580 maybe_diag_offset_bounds (location_t loc
, gcall
*call
, tree func
, int strict
,
1581 tree expr
, const builtin_memref
&ref
)
1583 if (!warn_array_bounds
)
1586 offset_int ooboff
[] = { ref
.offrange
[0], ref
.offrange
[1] };
1587 tree oobref
= ref
.offset_out_of_bounds (strict
, ooboff
);
1591 if (EXPR_HAS_LOCATION (expr
))
1592 loc
= EXPR_LOCATION (expr
);
1594 loc
= expansion_point_location_if_in_system_header (loc
);
1596 char rangestr
[2][64];
1597 if (ooboff
[0] == ooboff
[1]
1598 || (ooboff
[0] != ref
.offrange
[0]
1599 && ooboff
[0].to_shwi () >= ooboff
[1].to_shwi ()))
1600 sprintf (rangestr
[0], "%lli", (long long) ooboff
[0].to_shwi ());
1602 sprintf (rangestr
[0], "[%lli, %lli]",
1603 (long long) ooboff
[0].to_shwi (),
1604 (long long) ooboff
[1].to_shwi ());
1606 bool warned
= false;
1608 if (oobref
== error_mark_node
)
1610 if (ref
.sizrange
[0] == ref
.sizrange
[1])
1611 sprintf (rangestr
[1], "%lli", (long long) ref
.sizrange
[0].to_shwi ());
1613 sprintf (rangestr
[1], "[%lli, %lli]",
1614 (long long) ref
.sizrange
[0].to_shwi (),
1615 (long long) ref
.sizrange
[1].to_shwi ());
1619 if (DECL_P (ref
.base
)
1620 && TREE_CODE (type
= TREE_TYPE (ref
.base
)) == ARRAY_TYPE
)
1622 if (warning_at (loc
, OPT_Warray_bounds
,
1623 "%G%qD pointer overflow between offset %s "
1624 "and size %s accessing array %qD with type %qT",
1625 call
, func
, rangestr
[0], rangestr
[1], ref
.base
, type
))
1627 inform (DECL_SOURCE_LOCATION (ref
.base
),
1628 "array %qD declared here", ref
.base
);
1632 warned
= warning_at (loc
, OPT_Warray_bounds
,
1633 "%G%qD pointer overflow between offset %s "
1635 call
, func
, rangestr
[0], rangestr
[1]);
1638 warned
= warning_at (loc
, OPT_Warray_bounds
,
1639 "%G%qD pointer overflow between offset %s "
1641 call
, func
, rangestr
[0], rangestr
[1]);
1643 else if (oobref
== ref
.base
)
1645 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
1647 /* True when the offset formed by an access to the reference
1648 is out of bounds, rather than the initial offset wich is
1649 in bounds. This implies access past the end. */
1650 bool form
= ooboff
[0] != ref
.offrange
[0];
1652 if (DECL_P (ref
.base
))
1654 if ((ref
.basesize
< maxobjsize
1655 && warning_at (loc
, OPT_Warray_bounds
,
1657 ? G_("%G%qD forming offset %s is out of "
1658 "the bounds [0, %wu] of object %qD with "
1660 : G_("%G%qD offset %s is out of the bounds "
1661 "[0, %wu] of object %qD with type %qT"),
1662 call
, func
, rangestr
[0], ref
.basesize
.to_uhwi (),
1663 ref
.base
, TREE_TYPE (ref
.base
)))
1664 || warning_at (loc
, OPT_Warray_bounds
,
1666 ? G_("%G%qD forming offset %s is out of "
1667 "the bounds of object %qD with type %qT")
1668 : G_("%G%qD offset %s is out of the bounds "
1669 "of object %qD with type %qT"),
1670 call
, func
, rangestr
[0],
1671 ref
.base
, TREE_TYPE (ref
.base
)))
1673 inform (DECL_SOURCE_LOCATION (ref
.base
),
1674 "%qD declared here", ref
.base
);
1678 else if (ref
.basesize
< maxobjsize
)
1679 warned
= warning_at (loc
, OPT_Warray_bounds
,
1681 ? G_("%G%qD forming offset %s is out "
1682 "of the bounds [0, %wu]")
1683 : G_("%G%qD offset %s is out "
1684 "of the bounds [0, %wu]"),
1685 call
, func
, rangestr
[0], ref
.basesize
.to_uhwi ());
1687 warned
= warning_at (loc
, OPT_Warray_bounds
,
1689 ? G_("%G%qD forming offset %s is out of bounds")
1690 : G_("%G%qD offset %s is out of bounds"),
1691 call
, func
, rangestr
[0]);
1693 else if (TREE_CODE (ref
.ref
) == MEM_REF
)
1695 tree type
= TREE_TYPE (TREE_OPERAND (ref
.ref
, 0));
1696 if (POINTER_TYPE_P (type
))
1697 type
= TREE_TYPE (type
);
1698 type
= TYPE_MAIN_VARIANT (type
);
1700 warned
= warning_at (loc
, OPT_Warray_bounds
,
1701 "%G%qD offset %s from the object at %qE is out "
1702 "of the bounds of %qT",
1703 call
, func
, rangestr
[0], ref
.base
, type
);
1707 tree type
= TYPE_MAIN_VARIANT (TREE_TYPE (ref
.ref
));
1709 warned
= warning_at (loc
, OPT_Warray_bounds
,
1710 "%G%qD offset %s from the object at %qE is out "
1711 "of the bounds of referenced subobject %qD with "
1712 "type %qT at offset %wu",
1713 call
, func
, rangestr
[0], ref
.base
,
1714 TREE_OPERAND (ref
.ref
, 1), type
,
1715 ref
.refoff
.to_uhwi ());
1721 /* Check a CALL statement for restrict-violations and issue warnings
1722 if/when appropriate. */
1725 wrestrict_dom_walker::check_call (gcall
*call
)
1727 /* Avoid checking the call if it has already been diagnosed for
1729 if (gimple_no_warning_p (call
))
1732 tree func
= gimple_call_fndecl (call
);
1733 if (!func
|| DECL_BUILT_IN_CLASS (func
) != BUILT_IN_NORMAL
)
1736 /* Argument number to extract from the call (depends on the built-in
1738 unsigned dst_idx
= -1;
1739 unsigned src_idx
= -1;
1740 unsigned bnd_idx
= -1;
1742 /* Is this CALL to a string function (as opposed to one to a raw
1743 memory function). */
1746 switch (DECL_FUNCTION_CODE (func
))
1748 case BUILT_IN_MEMCPY
:
1749 case BUILT_IN_MEMCPY_CHK
:
1750 case BUILT_IN_MEMPCPY
:
1751 case BUILT_IN_MEMPCPY_CHK
:
1752 case BUILT_IN_MEMMOVE
:
1753 case BUILT_IN_MEMMOVE_CHK
:
1757 case BUILT_IN_STPNCPY
:
1758 case BUILT_IN_STPNCPY_CHK
:
1759 case BUILT_IN_STRNCAT
:
1760 case BUILT_IN_STRNCAT_CHK
:
1761 case BUILT_IN_STRNCPY
:
1762 case BUILT_IN_STRNCPY_CHK
:
1768 case BUILT_IN_STPCPY
:
1769 case BUILT_IN_STPCPY_CHK
:
1770 case BUILT_IN_STRCPY
:
1771 case BUILT_IN_STRCPY_CHK
:
1772 case BUILT_IN_STRCAT
:
1773 case BUILT_IN_STRCAT_CHK
:
1779 /* Handle other string functions here whose access may need
1780 to be validated for in-bounds offsets and non-overlapping
1785 unsigned nargs
= gimple_call_num_args (call
);
1787 tree dst
= dst_idx
< nargs
? gimple_call_arg (call
, dst_idx
) : NULL_TREE
;
1788 tree src
= src_idx
< nargs
? gimple_call_arg (call
, src_idx
) : NULL_TREE
;
1789 tree dstwr
= bnd_idx
< nargs
? gimple_call_arg (call
, bnd_idx
) : NULL_TREE
;
1791 /* For string functions with an unspecified or unknown bound,
1792 assume the size of the access is one. */
1793 if (!dstwr
&& strfun
)
1794 dstwr
= size_one_node
;
1796 /* DST and SRC can be null for a call with an insufficient number
1797 of arguments to a built-in function declared without a protype. */
1801 /* DST, SRC, or DSTWR can also have the wrong type in a call to
1802 a function declared without a prototype. Avoid checking such
1804 if (TREE_CODE (TREE_TYPE (dst
)) != POINTER_TYPE
1805 || TREE_CODE (TREE_TYPE (src
)) != POINTER_TYPE
1806 || (dstwr
&& !INTEGRAL_TYPE_P (TREE_TYPE (dstwr
))))
1809 if (check_bounds_or_overlap (call
, dst
, src
, dstwr
, NULL_TREE
))
1812 /* Avoid diagnosing the call again. */
1813 gimple_set_no_warning (call
, true);
1816 } /* anonymous namespace */
1818 /* Attempt to detect and diagnose invalid offset bounds and (except for
1819 memmove) overlapping copy in a call expression EXPR from SRC to DST
1820 and DSTSIZE and SRCSIZE bytes, respectively. Both DSTSIZE and
1821 SRCSIZE may be NULL. Return false when one or the other has been
1822 detected and diagnosed, true otherwise. */
1825 check_bounds_or_overlap (gcall
*call
, tree dst
, tree src
, tree dstsize
,
1826 tree srcsize
, bool bounds_only
/* = false */)
1828 location_t loc
= gimple_nonartificial_location (call
);
1829 loc
= expansion_point_location_if_in_system_header (loc
);
1831 tree func
= gimple_call_fndecl (call
);
1833 builtin_memref
dstref (dst
, dstsize
);
1834 builtin_memref
srcref (src
, srcsize
);
1836 builtin_access
acs (call
, dstref
, srcref
);
1838 /* Set STRICT to the value of the -Warray-bounds=N argument for
1839 string functions or when N > 1. */
1840 int strict
= (acs
.strict () || warn_array_bounds
> 1 ? warn_array_bounds
: 0);
1842 /* Validate offsets first to make sure they are within the bounds
1843 of the destination object if its size is known, or PTRDIFF_MAX
1845 if (maybe_diag_offset_bounds (loc
, call
, func
, strict
, dst
, dstref
)
1846 || maybe_diag_offset_bounds (loc
, call
, func
, strict
, src
, srcref
))
1848 gimple_set_no_warning (call
, true);
1855 || (DECL_FUNCTION_CODE (func
) != BUILT_IN_MEMMOVE
1856 && DECL_FUNCTION_CODE (func
) != BUILT_IN_MEMMOVE_CHK
)));
1861 if (operand_equal_p (dst
, src
, 0))
1863 /* Issue -Wrestrict unless the pointers are null (those do
1864 not point to objects and so do not indicate an overlap;
1865 such calls could be the result of sanitization and jump
1867 if (!integer_zerop (dst
) && !gimple_no_warning_p (call
))
1869 warning_at (loc
, OPT_Wrestrict
,
1870 "%G%qD source argument is the same as destination",
1872 gimple_set_no_warning (call
, true);
1879 /* Return false when overlap has been detected. */
1880 if (maybe_diag_overlap (loc
, call
, acs
))
1882 gimple_set_no_warning (call
, true);
1890 make_pass_warn_restrict (gcc::context
*ctxt
)
1892 return new pass_wrestrict (ctxt
);