1 /* Pass to detect and issue warnings for violations of the restrict
3 Copyright (C) 2017-2018 Free Software Foundation, Inc.
4 Contributed by Martin Sebor <msebor@redhat.com>.
6 This file is part of GCC.
8 GCC is free software; you can redistribute it and/or modify it under
9 the terms of the GNU General Public License as published by the Free
10 Software Foundation; either version 3, or (at your option) any later
13 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
14 WARRANTY; without even the implied warranty of MERCHANTABILITY or
15 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
18 You should have received a copy of the GNU General Public License
19 along with GCC; see the file COPYING3. If not see
20 <http://www.gnu.org/licenses/>. */
24 #include "coretypes.h"
29 #include "tree-pass.h"
32 #include "gimple-pretty-print.h"
33 #include "gimple-ssa-warn-restrict.h"
34 #include "diagnostic-core.h"
35 #include "fold-const.h"
36 #include "gimple-iterator.h"
41 #include "tree-object-size.h"
48 const pass_data pass_data_wrestrict
= {
53 PROP_cfg
, /* Properties_required. */
54 0, /* properties_provided. */
55 0, /* properties_destroyed. */
56 0, /* properties_start */
57 0, /* properties_finish */
60 /* Pass to detect violations of strict aliasing requirements in calls
61 to built-in string and raw memory functions. */
62 class pass_wrestrict
: public gimple_opt_pass
65 pass_wrestrict (gcc::context
*ctxt
)
66 : gimple_opt_pass (pass_data_wrestrict
, ctxt
)
69 opt_pass
*clone () { return new pass_wrestrict (m_ctxt
); }
71 virtual bool gate (function
*);
72 virtual unsigned int execute (function
*);
76 pass_wrestrict::gate (function
*fun ATTRIBUTE_UNUSED
)
78 return warn_array_bounds
!= 0 || warn_restrict
!= 0;
81 /* Class to walk the basic blocks of a function in dominator order. */
82 class wrestrict_dom_walker
: public dom_walker
85 wrestrict_dom_walker () : dom_walker (CDI_DOMINATORS
) {}
87 edge
before_dom_children (basic_block
) FINAL OVERRIDE
;
88 bool handle_gimple_call (gimple_stmt_iterator
*);
91 void check_call (gcall
*);
95 wrestrict_dom_walker::before_dom_children (basic_block bb
)
97 /* Iterate over statements, looking for function calls. */
98 for (gimple_stmt_iterator si
= gsi_start_bb (bb
); !gsi_end_p (si
);
101 gimple
*stmt
= gsi_stmt (si
);
102 if (!is_gimple_call (stmt
))
105 if (gcall
*call
= as_a
<gcall
*> (stmt
))
112 /* Execute the pass for function FUN, walking in dominator order. */
115 pass_wrestrict::execute (function
*fun
)
117 calculate_dominance_info (CDI_DOMINATORS
);
119 wrestrict_dom_walker walker
;
120 walker
.walk (ENTRY_BLOCK_PTR_FOR_FN (fun
));
125 /* Description of a memory reference by a built-in function. This
126 is similar to ao_ref but made especially suitable for -Wrestrict
127 and not for optimization. */
128 struct builtin_memref
130 /* The original pointer argument to the built-in function. */
132 /* The referenced subobject or NULL if not available, and the base
133 object of the memory reference or NULL. */
137 /* The size of the BASE object, PTRDIFF_MAX if indeterminate,
138 and negative until (possibly lazily) initialized. */
141 /* The non-negative offset of the referenced subobject. Used to avoid
142 warnings for (apparently) possibly but not definitively overlapping
143 accesses to member arrays. Negative when unknown/invalid. */
146 /* The offset range relative to the base. */
147 offset_int offrange
[2];
148 /* The size range of the access to this reference. */
149 offset_int sizrange
[2];
151 /* True for "bounded" string functions like strncat, and strncpy
152 and their variants that specify either an exact or upper bound
153 on the size of the accesses they perform. For strncat both
154 the source and destination references are bounded. For strncpy
155 only the destination reference is. */
158 builtin_memref (tree
, tree
);
160 tree
offset_out_of_bounds (int, offset_int
[2]) const;
163 /* Description of a memory access by a raw memory or string built-in
164 function involving a pair of builtin_memref's. */
168 /* Destination and source memory reference. */
169 builtin_memref
* const dstref
;
170 builtin_memref
* const srcref
;
171 /* The size range of the access. It's the greater of the accesses
172 to the two references. */
173 HOST_WIDE_INT sizrange
[2];
175 /* The minimum and maximum offset of an overlap of the access
176 (if it does, in fact, overlap), and the size of the overlap. */
177 HOST_WIDE_INT ovloff
[2];
178 HOST_WIDE_INT ovlsiz
[2];
180 /* True to consider valid only accesses to the smallest subobject
181 and false for raw memory functions. */
184 return detect_overlap
!= &builtin_access::generic_overlap
;
187 builtin_access (gcall
*, builtin_memref
&, builtin_memref
&);
189 /* Entry point to determine overlap. */
193 /* Implementation functions used to determine overlap. */
194 bool generic_overlap ();
195 bool strcat_overlap ();
196 bool strcpy_overlap ();
203 offset_int
overlap_size (const offset_int
[2], const offset_int
[2],
207 /* Temporaries used to compute the final result. */
208 offset_int dstoff
[2];
209 offset_int srcoff
[2];
210 offset_int dstsiz
[2];
211 offset_int srcsiz
[2];
213 /* Pointer to a member function to call to determine overlap. */
214 bool (builtin_access::*detect_overlap
) ();
217 /* Initialize a memory reference representation from a pointer EXPR and
218 a size SIZE in bytes. If SIZE is NULL_TREE then the size is assumed
221 builtin_memref::builtin_memref (tree expr
, tree size
)
226 refoff (HOST_WIDE_INT_MIN
),
231 /* Unfortunately, wide_int default ctor is a no-op so array members
232 of the type must be set individually. */
233 offrange
[0] = offrange
[1] = 0;
234 sizrange
[0] = sizrange
[1] = 0;
236 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
238 if (TREE_CODE (expr
) == SSA_NAME
)
240 /* Try to tease the offset out of the pointer. */
241 gimple
*stmt
= SSA_NAME_DEF_STMT (expr
);
242 if (gimple_assign_single_p (stmt
)
243 && gimple_assign_rhs_code (stmt
) == ADDR_EXPR
)
244 expr
= gimple_assign_rhs1 (stmt
);
245 else if (is_gimple_assign (stmt
))
247 tree_code code
= gimple_assign_rhs_code (stmt
);
248 if (code
== NOP_EXPR
)
250 tree rhs
= gimple_assign_rhs1 (stmt
);
251 if (POINTER_TYPE_P (TREE_TYPE (rhs
)))
252 expr
= gimple_assign_rhs1 (stmt
);
254 else if (code
== POINTER_PLUS_EXPR
)
256 expr
= gimple_assign_rhs1 (stmt
);
258 tree offset
= gimple_assign_rhs2 (stmt
);
259 if (TREE_CODE (offset
) == INTEGER_CST
)
261 offset_int off
= int_cst_value (offset
);
265 if (TREE_CODE (expr
) == SSA_NAME
)
267 gimple
*stmt
= SSA_NAME_DEF_STMT (expr
);
268 if (gimple_assign_single_p (stmt
)
269 && gimple_assign_rhs_code (stmt
) == ADDR_EXPR
)
270 expr
= gimple_assign_rhs1 (stmt
);
273 else if (TREE_CODE (offset
) == SSA_NAME
)
276 value_range_type rng
= get_range_info (offset
, &min
, &max
);
279 offrange
[0] = offset_int::from (min
, SIGNED
);
280 offrange
[1] = offset_int::from (max
, SIGNED
);
282 else if (rng
== VR_ANTI_RANGE
)
284 offrange
[0] = offset_int::from (max
+ 1, SIGNED
);
285 offrange
[1] = offset_int::from (min
- 1, SIGNED
);
289 gimple
*stmt
= SSA_NAME_DEF_STMT (offset
);
291 if (is_gimple_assign (stmt
)
292 && gimple_assign_rhs_code (stmt
) == NOP_EXPR
293 && (type
= TREE_TYPE (gimple_assign_rhs1 (stmt
)))
294 && INTEGRAL_TYPE_P (type
))
296 /* Use the bounds of the type of the NOP_EXPR operand
297 even if it's signed. The result doesn't trigger
298 warnings but makes their output more readable. */
299 offrange
[0] = wi::to_offset (TYPE_MIN_VALUE (type
));
300 offrange
[1] = wi::to_offset (TYPE_MAX_VALUE (type
));
303 offrange
[1] = maxobjsize
;
307 offrange
[1] = maxobjsize
;
312 if (TREE_CODE (expr
) == ADDR_EXPR
)
315 tree op
= TREE_OPERAND (expr
, 0);
317 /* Determine the base object or pointer of the reference
318 and its constant offset from the beginning of the base. */
319 base
= get_addr_base_and_unit_offset (op
, &off
);
321 HOST_WIDE_INT const_off
;
322 if (base
&& off
.is_constant (&const_off
))
324 offrange
[0] += const_off
;
325 offrange
[1] += const_off
;
327 /* Stash the reference for offset validation. */
330 /* Also stash the constant offset for offset validation. */
331 if (TREE_CODE (op
) == COMPONENT_REF
)
337 base
= get_base_address (TREE_OPERAND (expr
, 0));
342 base
= build2 (MEM_REF
, char_type_node
, expr
, null_pointer_node
);
344 if (TREE_CODE (base
) == MEM_REF
)
347 if (mem_ref_offset (base
).is_constant (&off
))
355 base
= TREE_OPERAND (base
, 0);
358 if (TREE_CODE (base
) == SSA_NAME
)
359 if (gimple
*stmt
= SSA_NAME_DEF_STMT (base
))
361 enum gimple_code code
= gimple_code (stmt
);
362 if (code
== GIMPLE_ASSIGN
)
363 if (gimple_assign_rhs_code (stmt
) == POINTER_PLUS_EXPR
)
365 base
= gimple_assign_rhs1 (stmt
);
367 tree offset
= gimple_assign_rhs2 (stmt
);
368 if (TREE_CODE (offset
) == INTEGER_CST
)
370 offset_int off
= int_cst_value (offset
);
378 if (DECL_P (base
) && TREE_CODE (TREE_TYPE (base
)) == ARRAY_TYPE
)
380 /* For array objects, where a negative offset wouldn't make
381 sense, use zero instead if the upper bound is positive. */
382 if (offrange
[0] < 0 && offrange
[1] > 0)
389 /* Determine the size range, allowing for the result to be [0, 0]
390 for SIZE in the anti-range ~[0, N] where N >= PTRDIFF_MAX. */
391 get_size_range (size
, range
, true);
392 sizrange
[0] = wi::to_offset (range
[0]);
393 sizrange
[1] = wi::to_offset (range
[1]);
394 /* get_size_range returns SIZE_MAX for the maximum size.
395 Constrain it to the real maximum of PTRDIFF_MAX. */
396 if (sizrange
[1] > maxobjsize
)
397 sizrange
[1] = maxobjsize
;
400 sizrange
[1] = maxobjsize
;
403 /* Return error_mark_node if the signed offset exceeds the bounds
404 of the address space (PTRDIFF_MAX). Otherwise, return either
405 BASE or REF when the offset exceeds the bounds of the BASE or
406 REF object, and set OOBOFF to the past-the-end offset formed
407 by the reference, including its size. When STRICT is non-zero
408 use REF size, when available, otherwise use BASE size. When
409 STRICT is greater than 1, use the size of the last array member
410 as the bound, otherwise treat such a member as a flexible array
411 member. Return NULL when the offset is in bounds. */
414 builtin_memref::offset_out_of_bounds (int strict
, offset_int ooboff
[2]) const
416 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
418 /* A temporary, possibly adjusted, copy of the offset range. */
419 offset_int offrng
[2] = { offrange
[0], offrange
[1] };
421 if (DECL_P (base
) && TREE_CODE (TREE_TYPE (base
)) == ARRAY_TYPE
)
423 /* Check for offset in an anti-range with a negative lower bound.
424 For such a range, consider only the non-negative subrange. */
425 if (offrng
[1] < offrng
[0] && offrng
[1] < 0)
426 offrng
[1] = maxobjsize
;
429 /* Conservative offset of the last byte of the referenced object. */
432 /* The bounds need not be ordered. Set HIB to use as the index
433 of the larger of the bounds and LOB as the opposite. */
434 bool hib
= wi::les_p (offrng
[0], offrng
[1]);
439 endoff
= offrng
[lob
] + sizrange
[0];
441 /* For a reference through a pointer to an object of unknown size
442 all initial offsets are considered valid, positive as well as
443 negative, since the pointer itself can point past the beginning
444 of the object. However, the sum of the lower bound of the offset
445 and that of the size must be less than or equal than PTRDIFF_MAX. */
446 if (endoff
> maxobjsize
)
447 return error_mark_node
;
452 /* A reference to an object of known size must be within the bounds
453 of the base object. */
454 if (offrng
[hib
] < 0 || offrng
[lob
] > basesize
)
457 /* The extent of the reference must also be within the bounds of
458 the base object (if known) or the maximum object size otherwise. */
459 endoff
= wi::smax (offrng
[lob
], 0) + sizrange
[0];
460 if (endoff
> maxobjsize
)
461 return error_mark_node
;
463 offset_int size
= basesize
;
470 && TREE_CODE (ref
) == COMPONENT_REF
472 || !array_at_struct_end_p (ref
)))
474 /* If the reference is to a member subobject, the offset must
475 be within the bounds of the subobject. */
476 tree field
= TREE_OPERAND (ref
, 1);
477 tree type
= TREE_TYPE (field
);
478 if (tree sz
= TYPE_SIZE_UNIT (type
))
479 if (TREE_CODE (sz
) == INTEGER_CST
)
481 size
= refoff
+ wi::to_offset (sz
);
489 /* Set the out-of-bounds offset range to be one greater than
490 that delimited by the reference including its size. */
491 ooboff
[lob
] = size
+ 1;
493 if (endoff
> ooboff
[lob
])
494 ooboff
[hib
] = endoff
;
496 ooboff
[hib
] = wi::smax (offrng
[lob
], 0) + sizrange
[1];
501 /* Create an association between the memory references DST and SRC
502 for access by a call EXPR to a memory or string built-in funtion. */
504 builtin_access::builtin_access (gcall
*call
, builtin_memref
&dst
,
506 : dstref (&dst
), srcref (&src
), sizrange (), ovloff (), ovlsiz (),
507 dstoff (), srcoff (), dstsiz (), srcsiz ()
509 /* Zero out since the offset_int ctors invoked above are no-op. */
510 dstoff
[0] = dstoff
[1] = 0;
511 srcoff
[0] = srcoff
[1] = 0;
512 dstsiz
[0] = dstsiz
[1] = 0;
513 srcsiz
[0] = srcsiz
[1] = 0;
515 /* Object Size Type to use to determine the size of the destination
516 and source objects. Overridden below for raw memory functions. */
519 /* True when the size of one reference depends on the offset of
520 itself or the other. */
521 bool depends_p
= true;
523 /* True when the size of the destination reference DSTREF has been
524 determined from SRCREF and so needs to be adjusted by the latter's
525 offset. Only meaningful for bounded string functions like strncpy. */
526 bool dstadjust_p
= false;
528 /* The size argument number (depends on the built-in). */
529 unsigned sizeargno
= 2;
530 if (gimple_call_with_bounds_p (call
))
533 tree func
= gimple_call_fndecl (call
);
534 switch (DECL_FUNCTION_CODE (func
))
536 case BUILT_IN_MEMCPY
:
537 case BUILT_IN_MEMCPY_CHK
:
538 case BUILT_IN_MEMCPY_CHKP
:
539 case BUILT_IN_MEMCPY_CHK_CHKP
:
540 case BUILT_IN_MEMPCPY
:
541 case BUILT_IN_MEMPCPY_CHK
:
542 case BUILT_IN_MEMPCPY_CHKP
:
543 case BUILT_IN_MEMPCPY_CHK_CHKP
:
546 detect_overlap
= &builtin_access::generic_overlap
;
549 case BUILT_IN_MEMMOVE
:
550 case BUILT_IN_MEMMOVE_CHK
:
551 case BUILT_IN_MEMMOVE_CHKP
:
552 case BUILT_IN_MEMMOVE_CHK_CHKP
:
553 /* For memmove there is never any overlap to check for. */
556 detect_overlap
= &builtin_access::no_overlap
;
559 case BUILT_IN_STPNCPY
:
560 case BUILT_IN_STPNCPY_CHK
:
561 case BUILT_IN_STRNCPY
:
562 case BUILT_IN_STRNCPY_CHK
:
563 dstref
->strbounded_p
= true;
564 detect_overlap
= &builtin_access::strcpy_overlap
;
567 case BUILT_IN_STPCPY
:
568 case BUILT_IN_STPCPY_CHK
:
569 case BUILT_IN_STPCPY_CHKP
:
570 case BUILT_IN_STPCPY_CHK_CHKP
:
571 case BUILT_IN_STRCPY
:
572 case BUILT_IN_STRCPY_CHK
:
573 case BUILT_IN_STRCPY_CHKP
:
574 case BUILT_IN_STRCPY_CHK_CHKP
:
575 detect_overlap
= &builtin_access::strcpy_overlap
;
578 case BUILT_IN_STRCAT
:
579 case BUILT_IN_STRCAT_CHK
:
580 case BUILT_IN_STRCAT_CHKP
:
581 case BUILT_IN_STRCAT_CHK_CHKP
:
582 detect_overlap
= &builtin_access::strcat_overlap
;
585 case BUILT_IN_STRNCAT
:
586 case BUILT_IN_STRNCAT_CHK
:
587 dstref
->strbounded_p
= true;
588 srcref
->strbounded_p
= true;
589 detect_overlap
= &builtin_access::strcat_overlap
;
593 /* Handle other string functions here whose access may need
594 to be validated for in-bounds offsets and non-overlapping
595 copies. (Not all _chkp functions have BUILT_IN_XXX_CHKP
596 macros so they need to be handled here.) */
600 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
602 /* Try to determine the size of the base object. compute_objsize
603 expects a pointer so create one if BASE is a non-pointer object. */
605 if (dst
.basesize
< 0)
608 if (!POINTER_TYPE_P (TREE_TYPE (addr
)))
609 addr
= build1 (ADDR_EXPR
, (TREE_TYPE (addr
)), addr
);
611 if (tree dstsize
= compute_objsize (addr
, ostype
))
612 dst
.basesize
= wi::to_offset (dstsize
);
613 else if (POINTER_TYPE_P (TREE_TYPE (addr
)))
614 dst
.basesize
= HOST_WIDE_INT_MIN
;
616 dst
.basesize
= maxobjsize
;
619 if (src
.basesize
< 0)
622 if (!POINTER_TYPE_P (TREE_TYPE (addr
)))
623 addr
= build1 (ADDR_EXPR
, (TREE_TYPE (addr
)), addr
);
625 if (tree srcsize
= compute_objsize (addr
, ostype
))
626 src
.basesize
= wi::to_offset (srcsize
);
627 else if (POINTER_TYPE_P (TREE_TYPE (addr
)))
628 src
.basesize
= HOST_WIDE_INT_MIN
;
630 src
.basesize
= maxobjsize
;
633 /* If there is no dependency between the references or the base
634 objects of the two references aren't the same there's nothing
636 if (depends_p
&& dstref
->base
!= srcref
->base
)
639 /* ...otherwise, make adjustments for references to the same object
640 by string built-in functions to reflect the constraints imposed
643 /* For bounded string functions determine the range of the bound
644 on the access. For others, the range stays unbounded. */
645 offset_int bounds
[2] = { maxobjsize
, maxobjsize
};
646 if (dstref
->strbounded_p
)
648 tree size
= gimple_call_arg (call
, sizeargno
);
650 if (get_size_range (size
, range
, true))
652 bounds
[0] = wi::to_offset (range
[0]);
653 bounds
[1] = wi::to_offset (range
[1]);
656 /* If both references' size ranges are indeterminate use the last
657 (size) argument from the function call as a substitute. This
658 may only be necessary for strncpy (but not for memcpy where
659 the size range would have been already determined this way). */
660 if (dstref
->sizrange
[0] == 0 && dstref
->sizrange
[1] == maxobjsize
661 && srcref
->sizrange
[0] == 0 && srcref
->sizrange
[1] == maxobjsize
)
663 dstref
->sizrange
[0] = bounds
[0];
664 dstref
->sizrange
[1] = bounds
[1];
668 /* The size range of one reference involving the same base object
669 can be determined from the size range of the other reference.
670 This makes it possible to compute accurate offsets for warnings
671 involving functions like strcpy where the length of just one of
672 the two arguments is known (determined by tree-ssa-strlen). */
673 if (dstref
->sizrange
[0] == 0 && dstref
->sizrange
[1] == maxobjsize
)
675 /* When the destination size is unknown set it to the size of
677 dstref
->sizrange
[0] = srcref
->sizrange
[0];
678 dstref
->sizrange
[1] = srcref
->sizrange
[1];
680 else if (srcref
->sizrange
[0] == 0 && srcref
->sizrange
[1] == maxobjsize
)
682 /* When the source size is unknown set it to the size of
684 srcref
->sizrange
[0] = dstref
->sizrange
[0];
685 srcref
->sizrange
[1] = dstref
->sizrange
[1];
689 if (dstref
->strbounded_p
)
691 /* Read access by strncpy is bounded. */
692 if (bounds
[0] < srcref
->sizrange
[0])
693 srcref
->sizrange
[0] = bounds
[0];
694 if (bounds
[1] < srcref
->sizrange
[1])
695 srcref
->sizrange
[1] = bounds
[1];
698 /* For string functions, adjust the size range of the source
699 reference by the inverse boundaries of the offset (because
700 the higher the offset into the string the shorter its
702 if (srcref
->offrange
[1] >= 0
703 && srcref
->offrange
[1] < srcref
->sizrange
[0])
704 srcref
->sizrange
[0] -= srcref
->offrange
[1];
706 srcref
->sizrange
[0] = 0;
708 if (srcref
->offrange
[0] > 0)
710 if (srcref
->offrange
[0] < srcref
->sizrange
[1])
711 srcref
->sizrange
[1] -= srcref
->offrange
[0];
713 srcref
->sizrange
[1] = 0;
720 if (detect_overlap
== &builtin_access::generic_overlap
)
722 if (dstref
->strbounded_p
)
724 dstref
->sizrange
[0] = bounds
[0];
725 dstref
->sizrange
[1] = bounds
[1];
727 if (dstref
->sizrange
[0] < srcref
->sizrange
[0])
728 srcref
->sizrange
[0] = dstref
->sizrange
[0];
730 if (dstref
->sizrange
[1] < srcref
->sizrange
[1])
731 srcref
->sizrange
[1] = dstref
->sizrange
[1];
734 else if (detect_overlap
== &builtin_access::strcpy_overlap
)
736 if (!dstref
->strbounded_p
)
738 /* For strcpy, adjust the destination size range to match that
739 of the source computed above. */
740 if (depends_p
&& dstadjust_p
)
742 dstref
->sizrange
[0] = srcref
->sizrange
[0];
743 dstref
->sizrange
[1] = srcref
->sizrange
[1];
748 if (dstref
->strbounded_p
)
750 /* For strncpy, adjust the destination size range to match that
751 of the source computed above. */
752 dstref
->sizrange
[0] = bounds
[0];
753 dstref
->sizrange
[1] = bounds
[1];
755 if (bounds
[0] < srcref
->sizrange
[0])
756 srcref
->sizrange
[0] = bounds
[0];
758 if (bounds
[1] < srcref
->sizrange
[1])
759 srcref
->sizrange
[1] = bounds
[1];
764 builtin_access::overlap_size (const offset_int a
[2], const offset_int b
[2],
767 const offset_int
*p
= a
;
768 const offset_int
*q
= b
;
770 /* Point P at the bigger of the two ranges and Q at the smaller. */
771 if (wi::lts_p (a
[1] - a
[0], b
[1] - b
[0]))
783 return wi::smin (p
[1], q
[1]) - q
[0];
793 /* Return true if the bounded mempry (memcpy amd similar) or string function
794 access (strncpy and similar) ACS overlaps. */
797 builtin_access::generic_overlap ()
799 builtin_access
&acs
= *this;
800 const builtin_memref
*dstref
= acs
.dstref
;
801 const builtin_memref
*srcref
= acs
.srcref
;
803 gcc_assert (dstref
->base
== srcref
->base
);
805 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
807 offset_int maxsize
= dstref
->basesize
< 0 ? maxobjsize
: dstref
->basesize
;
808 gcc_assert (maxsize
<= maxobjsize
);
810 /* Adjust the larger bounds of the offsets (which may be the first
811 element if the lower bound is larger than the upper bound) to
812 make them valid for the smallest access (if possible) but no smaller
813 than the smaller bounds. */
814 gcc_assert (wi::les_p (acs
.dstoff
[0], acs
.dstoff
[1]));
816 if (maxsize
< acs
.dstoff
[1] + acs
.dstsiz
[0])
817 acs
.dstoff
[1] = maxsize
- acs
.dstsiz
[0];
818 if (acs
.dstoff
[1] < acs
.dstoff
[0])
819 acs
.dstoff
[1] = acs
.dstoff
[0];
821 gcc_assert (wi::les_p (acs
.srcoff
[0], acs
.srcoff
[1]));
823 if (maxsize
< acs
.srcoff
[1] + acs
.srcsiz
[0])
824 acs
.srcoff
[1] = maxsize
- acs
.srcsiz
[0];
825 if (acs
.srcoff
[1] < acs
.srcoff
[0])
826 acs
.srcoff
[1] = acs
.srcoff
[0];
828 /* Determine the minimum and maximum space for the access given
831 space
[0] = wi::abs (acs
.dstoff
[0] - acs
.srcoff
[0]);
834 offset_int d
= wi::abs (acs
.dstoff
[0] - acs
.srcoff
[1]);
835 if (acs
.srcsiz
[0] > 0)
844 space
[1] = acs
.dstsiz
[1];
846 d
= wi::abs (acs
.dstoff
[1] - acs
.srcoff
[0]);
853 /* Treat raw memory functions both of whose references are bounded
854 as special and permit uncertain overlaps to go undetected. For
855 all kinds of constant offset and constant size accesses, if
856 overlap isn't certain it is not possible. */
857 bool overlap_possible
= space
[0] < acs
.dstsiz
[1];
858 if (!overlap_possible
)
861 bool overlap_certain
= space
[1] < acs
.dstsiz
[0];
863 /* True when the size of one reference depends on the offset of
865 bool depends_p
= detect_overlap
!= &builtin_access::generic_overlap
;
868 && !dstref
->strbounded_p
872 /* True for stpcpy and strcpy. */
873 bool stxcpy_p
= (!dstref
->strbounded_p
874 && detect_overlap
== &builtin_access::strcpy_overlap
);
876 if (dstref
->refoff
>= 0
877 && srcref
->refoff
>= 0
878 && dstref
->refoff
!= srcref
->refoff
879 && (stxcpy_p
|| dstref
->strbounded_p
|| srcref
->strbounded_p
))
882 offset_int siz
[2] = { maxobjsize
+ 1, 0 };
884 ovloff
[0] = HOST_WIDE_INT_MAX
;
885 ovloff
[1] = HOST_WIDE_INT_MIN
;
887 /* Adjustment to the lower bound of the offset of the overlap to
888 account for a subset of unbounded string calls where the size
889 of the destination string depends on the length of the source
890 which in turn depends on the offset into it. */
895 sub1
= acs
.dstoff
[0] <= acs
.srcoff
[0];
897 /* Iterate over the extreme locations (on the horizontal axis formed
898 by their offsets) and sizes of two regions and find their smallest
899 and largest overlap and the corresponding offsets. */
900 for (unsigned i
= 0; i
!= 2; ++i
)
902 const offset_int a
[2] = {
903 acs
.dstoff
[i
], acs
.dstoff
[i
] + acs
.dstsiz
[!i
]
906 const offset_int b
[2] = {
907 acs
.srcoff
[i
], acs
.srcoff
[i
] + acs
.srcsiz
[!i
]
911 offset_int sz
= overlap_size (a
, b
, &off
);
920 if (wi::lts_p (off
, ovloff
[0]))
921 ovloff
[0] = off
.to_shwi ();
922 if (wi::lts_p (ovloff
[1], off
))
923 ovloff
[1] = off
.to_shwi ();
931 /* Iterate over the extreme locations (on the horizontal axis
932 formed by their offsets) and sizes of two regions and find
933 their smallest and largest overlap and the corresponding
936 for (unsigned io
= 0; io
!= 2; ++io
)
937 for (unsigned is
= 0; is
!= 2; ++is
)
939 const offset_int a
[2] = {
940 acs
.dstoff
[io
], acs
.dstoff
[io
] + acs
.dstsiz
[is
]
943 for (unsigned jo
= 0; jo
!= 2; ++jo
)
944 for (unsigned js
= 0; js
!= 2; ++js
)
948 /* For st{p,r}ncpy the size of the source sequence
949 depends on the offset into it. */
955 const offset_int b
[2] = {
956 acs
.srcoff
[jo
], acs
.srcoff
[jo
] + acs
.srcsiz
[js
]
960 offset_int sz
= overlap_size (a
, b
, &off
);
969 if (wi::lts_p (off
, ovloff
[0]))
970 ovloff
[0] = off
.to_shwi ();
971 if (wi::lts_p (ovloff
[1], off
))
972 ovloff
[1] = off
.to_shwi ();
978 ovlsiz
[0] = siz
[0].to_shwi ();
979 ovlsiz
[1] = siz
[1].to_shwi ();
981 if (ovlsiz
[0] == 0 && ovlsiz
[1] > 1)
982 ovloff
[0] = ovloff
[1] + ovlsiz
[1] - 1 - sub1
;
987 /* Return true if the strcat-like access overlaps. */
990 builtin_access::strcat_overlap ()
992 builtin_access
&acs
= *this;
993 const builtin_memref
*dstref
= acs
.dstref
;
994 const builtin_memref
*srcref
= acs
.srcref
;
996 gcc_assert (dstref
->base
== srcref
->base
);
998 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
1000 gcc_assert (dstref
->base
&& dstref
->base
== srcref
->base
);
1002 /* Adjust for strcat-like accesses. */
1004 /* As a special case for strcat, set the DSTREF offsets to the length
1005 of the source string since the function starts writing at the first
1006 nul, and set the size to 1 for the length of the nul. */
1007 acs
.dstoff
[0] += acs
.dstsiz
[0];
1008 acs
.dstoff
[1] += acs
.dstsiz
[1];
1010 bool strfunc_unknown_args
= acs
.dstsiz
[0] == 0 && acs
.dstsiz
[1] != 0;
1012 /* The lower bound is zero when the size is unknown because then
1013 overlap is not certain. */
1014 acs
.dstsiz
[0] = strfunc_unknown_args
? 0 : 1;
1017 offset_int maxsize
= dstref
->basesize
< 0 ? maxobjsize
: dstref
->basesize
;
1018 gcc_assert (maxsize
<= maxobjsize
);
1020 /* For references to the same base object, determine if there's a pair
1021 of valid offsets into the two references such that access between
1022 them doesn't overlap. Adjust both upper bounds to be valid for
1023 the smaller size (i.e., at most MAXSIZE - SIZE). */
1025 if (maxsize
< acs
.dstoff
[1] + acs
.dstsiz
[0])
1026 acs
.dstoff
[1] = maxsize
- acs
.dstsiz
[0];
1028 if (maxsize
< acs
.srcoff
[1] + acs
.srcsiz
[0])
1029 acs
.srcoff
[1] = maxsize
- acs
.srcsiz
[0];
1031 /* Check to see if there's enough space for both accesses without
1032 overlap. Determine the optimistic (maximum) amount of available
1035 if (acs
.dstoff
[0] <= acs
.srcoff
[0])
1037 if (acs
.dstoff
[1] < acs
.srcoff
[1])
1038 space
= acs
.srcoff
[1] + acs
.srcsiz
[0] - acs
.dstoff
[0];
1040 space
= acs
.dstoff
[1] + acs
.dstsiz
[0] - acs
.srcoff
[0];
1043 space
= acs
.dstoff
[1] + acs
.dstsiz
[0] - acs
.srcoff
[0];
1045 /* Overlap is certain if the distance between the farthest offsets
1046 of the opposite accesses is less than the sum of the lower bounds
1047 of the sizes of the two accesses. */
1048 bool overlap_certain
= space
< acs
.dstsiz
[0] + acs
.srcsiz
[0];
1050 /* For a constant-offset, constant size access, consider the largest
1051 distance between the offset bounds and the lower bound of the access
1052 size. If the overlap isn't certain return success. */
1053 if (!overlap_certain
1054 && acs
.dstoff
[0] == acs
.dstoff
[1]
1055 && acs
.srcoff
[0] == acs
.srcoff
[1]
1056 && acs
.dstsiz
[0] == acs
.dstsiz
[1]
1057 && acs
.srcsiz
[0] == acs
.srcsiz
[1])
1060 /* Overlap is not certain but may be possible. */
1062 offset_int access_min
= acs
.dstsiz
[0] + acs
.srcsiz
[0];
1064 /* Determine the conservative (minimum) amount of space. */
1065 space
= wi::abs (acs
.dstoff
[0] - acs
.srcoff
[0]);
1066 offset_int d
= wi::abs (acs
.dstoff
[0] - acs
.srcoff
[1]);
1069 d
= wi::abs (acs
.dstoff
[1] - acs
.srcoff
[0]);
1073 /* For a strict test (used for strcpy and similar with unknown or
1074 variable bounds or sizes), consider the smallest distance between
1075 the offset bounds and either the upper bound of the access size
1076 if known, or the lower bound otherwise. */
1077 if (access_min
<= space
&& (access_min
!= 0 || !strfunc_unknown_args
))
1080 /* When strcat overlap is certain it is always a single byte:
1081 the terminating NUL, regardless of offsets and sizes. When
1082 overlap is only possible its range is [0, 1]. */
1083 acs
.ovlsiz
[0] = dstref
->sizrange
[0] == dstref
->sizrange
[1] ? 1 : 0;
1086 offset_int endoff
= dstref
->offrange
[0] + dstref
->sizrange
[0];
1087 if (endoff
<= srcref
->offrange
[0])
1088 acs
.ovloff
[0] = wi::smin (maxobjsize
, srcref
->offrange
[0]).to_shwi ();
1090 acs
.ovloff
[0] = wi::smin (maxobjsize
, endoff
).to_shwi ();
1092 acs
.sizrange
[0] = wi::smax (wi::abs (endoff
- srcref
->offrange
[0]) + 1,
1093 srcref
->sizrange
[0]).to_shwi ();
1094 if (dstref
->offrange
[0] == dstref
->offrange
[1])
1096 if (srcref
->offrange
[0] == srcref
->offrange
[1])
1097 acs
.ovloff
[1] = acs
.ovloff
[0];
1100 = wi::smin (maxobjsize
,
1101 srcref
->offrange
[1] + srcref
->sizrange
[1]).to_shwi ();
1105 = wi::smin (maxobjsize
,
1106 dstref
->offrange
[1] + dstref
->sizrange
[1]).to_shwi ();
1108 if (acs
.sizrange
[0] == 0)
1109 acs
.sizrange
[0] = 1;
1110 acs
.sizrange
[1] = wi::smax (acs
.dstsiz
[1], srcref
->sizrange
[1]).to_shwi ();
1114 /* Return true if the strcpy-like access overlaps. */
1117 builtin_access::strcpy_overlap ()
1119 return generic_overlap ();
1123 /* Return true if DSTREF and SRCREF describe accesses that either overlap
1124 one another or that, in order not to overlap, would imply that the size
1125 of the referenced object(s) exceeds the maximum size of an object. Set
1126 Otherwise, if DSTREF and SRCREF do not definitely overlap (even though
1127 they may overlap in a way that's not apparent from the available data),
1131 builtin_access::overlap ()
1133 builtin_access
&acs
= *this;
1135 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
1137 acs
.sizrange
[0] = wi::smax (dstref
->sizrange
[0],
1138 srcref
->sizrange
[0]).to_shwi ();
1139 acs
.sizrange
[1] = wi::smax (dstref
->sizrange
[1],
1140 srcref
->sizrange
[1]).to_shwi ();
1142 /* Check to see if the two references refer to regions that are
1143 too large not to overlap in the address space (whose maximum
1144 size is PTRDIFF_MAX). */
1145 offset_int size
= dstref
->sizrange
[0] + srcref
->sizrange
[0];
1146 if (maxobjsize
< size
)
1148 acs
.ovloff
[0] = (maxobjsize
- dstref
->sizrange
[0]).to_shwi ();
1149 acs
.ovlsiz
[0] = (size
- maxobjsize
).to_shwi ();
1153 /* If both base objects aren't known return the maximum possible
1154 offset that would make them not overlap. */
1155 if (!dstref
->base
|| !srcref
->base
)
1158 /* Set the access offsets. */
1159 acs
.dstoff
[0] = dstref
->offrange
[0];
1160 acs
.dstoff
[1] = dstref
->offrange
[1];
1162 /* If the base object is an array adjust the bounds of the offset
1163 to be non-negative and within the bounds of the array if possible. */
1165 && TREE_CODE (TREE_TYPE (dstref
->base
)) == ARRAY_TYPE
)
1167 if (acs
.dstoff
[0] < 0 && acs
.dstoff
[1] >= 0)
1170 if (acs
.dstoff
[1] < acs
.dstoff
[0])
1172 if (tree size
= TYPE_SIZE_UNIT (TREE_TYPE (dstref
->base
)))
1173 acs
.dstoff
[1] = wi::umin (acs
.dstoff
[1], wi::to_offset (size
));
1175 acs
.dstoff
[1] = wi::umin (acs
.dstoff
[1], maxobjsize
);
1179 acs
.srcoff
[0] = srcref
->offrange
[0];
1180 acs
.srcoff
[1] = srcref
->offrange
[1];
1183 && TREE_CODE (TREE_TYPE (srcref
->base
)) == ARRAY_TYPE
)
1185 if (acs
.srcoff
[0] < 0 && acs
.srcoff
[1] >= 0)
1188 if (tree size
= TYPE_SIZE_UNIT (TREE_TYPE (srcref
->base
)))
1189 acs
.srcoff
[1] = wi::umin (acs
.srcoff
[1], wi::to_offset (size
));
1190 else if (acs
.srcoff
[1] < acs
.srcoff
[0])
1191 acs
.srcoff
[1] = wi::umin (acs
.srcoff
[1], maxobjsize
);
1194 /* When the upper bound of the offset is less than the lower bound
1195 the former is the result of a negative offset being represented
1196 as a large positive value or vice versa. The resulting range is
1197 a union of two subranges: [MIN, UB] and [LB, MAX]. Since such
1198 a union is not representable using the current data structure
1199 replace it with the full range of offsets. */
1200 if (acs
.dstoff
[1] < acs
.dstoff
[0])
1202 acs
.dstoff
[0] = -maxobjsize
- 1;
1203 acs
.dstoff
[1] = maxobjsize
;
1206 /* Validate the offset and size of each reference on its own first.
1207 This is independent of whether or not the base objects are the
1208 same. Normally, this would have already been detected and
1209 diagnosed by -Warray-bounds, unless it has been disabled. */
1210 offset_int maxoff
= acs
.dstoff
[0] + dstref
->sizrange
[0];
1211 if (maxobjsize
< maxoff
)
1213 acs
.ovlsiz
[0] = (maxoff
- maxobjsize
).to_shwi ();
1214 acs
.ovloff
[0] = acs
.dstoff
[0].to_shwi () - acs
.ovlsiz
[0];
1218 /* Repeat the same as above but for the source offsets. */
1219 if (acs
.srcoff
[1] < acs
.srcoff
[0])
1221 acs
.srcoff
[0] = -maxobjsize
- 1;
1222 acs
.srcoff
[1] = maxobjsize
;
1225 maxoff
= acs
.srcoff
[0] + srcref
->sizrange
[0];
1226 if (maxobjsize
< maxoff
)
1228 acs
.ovlsiz
[0] = (maxoff
- maxobjsize
).to_shwi ();
1229 acs
.ovlsiz
[1] = (acs
.srcoff
[0] + srcref
->sizrange
[1]
1230 - maxobjsize
).to_shwi ();
1231 acs
.ovloff
[0] = acs
.srcoff
[0].to_shwi () - acs
.ovlsiz
[0];
1235 if (dstref
->base
!= srcref
->base
)
1238 acs
.dstsiz
[0] = dstref
->sizrange
[0];
1239 acs
.dstsiz
[1] = dstref
->sizrange
[1];
1241 acs
.srcsiz
[0] = srcref
->sizrange
[0];
1242 acs
.srcsiz
[1] = srcref
->sizrange
[1];
1244 /* Call the appropriate function to determine the overlap. */
1245 if ((this->*detect_overlap
) ())
1249 /* Unless the access size range has already been set, do so here. */
1250 sizrange
[0] = wi::smax (acs
.dstsiz
[0], srcref
->sizrange
[0]).to_shwi ();
1251 sizrange
[1] = wi::smax (acs
.dstsiz
[1], srcref
->sizrange
[1]).to_shwi ();
1259 /* Attempt to detect and diagnose an overlapping copy in a call expression
1260 EXPR involving an an access ACS to a built-in memory or string function.
1261 Return true when one has been detected, false otherwise. */
1264 maybe_diag_overlap (location_t loc
, gcall
*call
, builtin_access
&acs
)
1266 if (!acs
.overlap ())
1269 /* For convenience. */
1270 const builtin_memref
&dstref
= *acs
.dstref
;
1271 const builtin_memref
&srcref
= *acs
.srcref
;
1273 /* Determine the range of offsets and sizes of the overlap if it
1274 exists and issue diagnostics. */
1275 HOST_WIDE_INT
*ovloff
= acs
.ovloff
;
1276 HOST_WIDE_INT
*ovlsiz
= acs
.ovlsiz
;
1277 HOST_WIDE_INT
*sizrange
= acs
.sizrange
;
1279 tree func
= gimple_call_fndecl (call
);
1281 /* To avoid a combinatorial explosion of diagnostics format the offsets
1282 or their ranges as strings and use them in the warning calls below. */
1285 if (dstref
.offrange
[0] == dstref
.offrange
[1]
1286 || dstref
.offrange
[1] > HOST_WIDE_INT_MAX
)
1287 sprintf (offstr
[0], HOST_WIDE_INT_PRINT_DEC
,
1288 dstref
.offrange
[0].to_shwi ());
1291 "[" HOST_WIDE_INT_PRINT_DEC
", " HOST_WIDE_INT_PRINT_DEC
"]",
1292 dstref
.offrange
[0].to_shwi (),
1293 dstref
.offrange
[1].to_shwi ());
1295 if (srcref
.offrange
[0] == srcref
.offrange
[1]
1296 || srcref
.offrange
[1] > HOST_WIDE_INT_MAX
)
1298 HOST_WIDE_INT_PRINT_DEC
,
1299 srcref
.offrange
[0].to_shwi ());
1302 "[" HOST_WIDE_INT_PRINT_DEC
", " HOST_WIDE_INT_PRINT_DEC
"]",
1303 srcref
.offrange
[0].to_shwi (),
1304 srcref
.offrange
[1].to_shwi ());
1306 if (ovloff
[0] == ovloff
[1] || !ovloff
[1])
1307 sprintf (offstr
[2], HOST_WIDE_INT_PRINT_DEC
, ovloff
[0]);
1310 "[" HOST_WIDE_INT_PRINT_DEC
", " HOST_WIDE_INT_PRINT_DEC
"]",
1311 ovloff
[0], ovloff
[1]);
1313 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
1314 bool must_overlap
= ovlsiz
[0] > 0;
1317 ovlsiz
[1] = ovlsiz
[0];
1321 /* Issue definitive "overlaps" diagnostic in this block. */
1323 if (sizrange
[0] == sizrange
[1])
1325 if (ovlsiz
[0] == ovlsiz
[1])
1326 warning_at (loc
, OPT_Wrestrict
,
1329 ? G_("%G%qD accessing %wu byte at offsets %s "
1330 "and %s overlaps %wu byte at offset %s")
1331 : G_("%G%qD accessing %wu byte at offsets %s "
1332 "and %s overlaps %wu bytes at offset "
1335 ? G_("%G%qD accessing %wu bytes at offsets %s "
1336 "and %s overlaps %wu byte at offset %s")
1337 : G_("%G%qD accessing %wu bytes at offsets %s "
1338 "and %s overlaps %wu bytes at offset "
1340 call
, func
, sizrange
[0],
1341 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1342 else if (ovlsiz
[1] >= 0 && ovlsiz
[1] < maxobjsize
.to_shwi ())
1343 warning_at (loc
, OPT_Wrestrict
,
1345 ? G_("%G%qD accessing %wu byte at offsets %s "
1346 "and %s overlaps between %wu and %wu bytes "
1348 : G_("%G%qD accessing %wu bytes at offsets %s "
1349 "and %s overlaps between %wu and %wu bytes "
1351 call
, func
, sizrange
[0],
1352 offstr
[0], offstr
[1], ovlsiz
[0], ovlsiz
[1],
1355 warning_at (loc
, OPT_Wrestrict
,
1357 ? G_("%G%qD accessing %wu byte at offsets %s and "
1358 "%s overlaps %wu or more bytes at offset %s")
1359 : G_("%G%qD accessing %wu bytes at offsets %s and "
1360 "%s overlaps %wu or more bytes at offset %s"),
1361 call
, func
, sizrange
[0],
1362 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1366 if (sizrange
[1] >= 0 && sizrange
[1] < maxobjsize
.to_shwi ())
1368 if (ovlsiz
[0] == ovlsiz
[1])
1369 warning_at (loc
, OPT_Wrestrict
,
1371 ? G_("%G%qD accessing between %wu and %wu bytes "
1372 "at offsets %s and %s overlaps %wu byte at "
1374 : G_("%G%qD accessing between %wu and %wu bytes "
1375 "at offsets %s and %s overlaps %wu bytes "
1377 call
, func
, sizrange
[0], sizrange
[1],
1378 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1379 else if (ovlsiz
[1] >= 0 && ovlsiz
[1] < maxobjsize
.to_shwi ())
1380 warning_at (loc
, OPT_Wrestrict
,
1381 "%G%qD accessing between %wu and %wu bytes at "
1382 "offsets %s and %s overlaps between %wu and %wu "
1383 "bytes at offset %s",
1384 call
, func
, sizrange
[0], sizrange
[1],
1385 offstr
[0], offstr
[1], ovlsiz
[0], ovlsiz
[1],
1388 warning_at (loc
, OPT_Wrestrict
,
1389 "%G%qD accessing between %wu and %wu bytes at "
1390 "offsets %s and %s overlaps %wu or more bytes "
1392 call
, func
, sizrange
[0], sizrange
[1],
1393 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1397 if (ovlsiz
[0] != ovlsiz
[1])
1398 ovlsiz
[1] = maxobjsize
.to_shwi ();
1400 if (ovlsiz
[0] == ovlsiz
[1])
1401 warning_at (loc
, OPT_Wrestrict
,
1403 ? G_("%G%qD accessing %wu or more bytes at offsets "
1404 "%s and %s overlaps %wu byte at offset %s")
1405 : G_("%G%qD accessing %wu or more bytes at offsets "
1406 "%s and %s overlaps %wu bytes at offset %s"),
1407 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1408 ovlsiz
[0], offstr
[2]);
1409 else if (ovlsiz
[1] >= 0 && ovlsiz
[1] < maxobjsize
.to_shwi ())
1410 warning_at (loc
, OPT_Wrestrict
,
1411 "%G%qD accessing %wu or more bytes at offsets %s "
1412 "and %s overlaps between %wu and %wu bytes "
1414 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1415 ovlsiz
[0], ovlsiz
[1], offstr
[2]);
1417 warning_at (loc
, OPT_Wrestrict
,
1418 "%G%qD accessing %wu or more bytes at offsets %s "
1419 "and %s overlaps %wu or more bytes at offset %s",
1420 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1421 ovlsiz
[0], offstr
[2]);
1425 /* Use more concise wording when one of the offsets is unbounded
1426 to avoid confusing the user with large and mostly meaningless
1429 if (DECL_P (dstref
.base
) && TREE_CODE (TREE_TYPE (dstref
.base
)) == ARRAY_TYPE
)
1430 open_range
= ((dstref
.offrange
[0] == 0
1431 && dstref
.offrange
[1] == maxobjsize
)
1432 || (srcref
.offrange
[0] == 0
1433 && srcref
.offrange
[1] == maxobjsize
));
1435 open_range
= ((dstref
.offrange
[0] == -maxobjsize
- 1
1436 && dstref
.offrange
[1] == maxobjsize
)
1437 || (srcref
.offrange
[0] == -maxobjsize
- 1
1438 && srcref
.offrange
[1] == maxobjsize
));
1440 if (sizrange
[0] == sizrange
[1] || sizrange
[1] == 1)
1445 warning_at (loc
, OPT_Wrestrict
,
1447 ? G_("%G%qD accessing %wu byte may overlap "
1449 : G_("%G%qD accessing %wu bytes may overlap "
1451 call
, func
, sizrange
[1], ovlsiz
[1]);
1453 warning_at (loc
, OPT_Wrestrict
,
1455 ? G_("%G%qD accessing %wu byte at offsets %s "
1456 "and %s may overlap %wu byte at offset %s")
1457 : G_("%G%qD accessing %wu bytes at offsets %s "
1458 "and %s may overlap %wu byte at offset %s"),
1459 call
, func
, sizrange
[1], offstr
[0], offstr
[1],
1460 ovlsiz
[1], offstr
[2]);
1465 warning_at (loc
, OPT_Wrestrict
,
1467 ? G_("%G%qD accessing %wu byte may overlap "
1469 : G_("%G%qD accessing %wu bytes may overlap "
1471 call
, func
, sizrange
[1], ovlsiz
[1]);
1473 warning_at (loc
, OPT_Wrestrict
,
1475 ? G_("%G%qD accessing %wu byte at offsets %s and "
1476 "%s may overlap up to %wu bytes at offset %s")
1477 : G_("%G%qD accessing %wu bytes at offsets %s and "
1478 "%s may overlap up to %wu bytes at offset %s"),
1479 call
, func
, sizrange
[1], offstr
[0], offstr
[1],
1480 ovlsiz
[1], offstr
[2]);
1484 if (sizrange
[1] >= 0 && sizrange
[1] < maxobjsize
.to_shwi ())
1487 warning_at (loc
, OPT_Wrestrict
,
1489 ? G_("%G%qD accessing between %wu and %wu bytes "
1490 "may overlap %wu byte")
1491 : G_("%G%qD accessing between %wu and %wu bytes "
1492 "may overlap up to %wu bytes"),
1493 call
, func
, sizrange
[0], sizrange
[1], ovlsiz
[1]);
1495 warning_at (loc
, OPT_Wrestrict
,
1497 ? G_("%G%qD accessing between %wu and %wu bytes "
1498 "at offsets %s and %s may overlap %wu byte "
1500 : G_("%G%qD accessing between %wu and %wu bytes "
1501 "at offsets %s and %s may overlap up to %wu "
1502 "bytes at offset %s"),
1503 call
, func
, sizrange
[0], sizrange
[1],
1504 offstr
[0], offstr
[1], ovlsiz
[1], offstr
[2]);
1508 warning_at (loc
, OPT_Wrestrict
,
1510 ? G_("%G%qD accessing %wu or more bytes at offsets %s "
1511 "and %s may overlap %wu byte at offset %s")
1512 : G_("%G%qD accessing %wu or more bytes at offsets %s "
1513 "and %s may overlap up to %wu bytes at offset %s"),
1514 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1515 ovlsiz
[1], offstr
[2]);
1520 /* Validate REF offsets in an EXPRession passed as an argument to a CALL
1521 to a built-in function FUNC to make sure they are within the bounds
1522 of the referenced object if its size is known, or PTRDIFF_MAX otherwise.
1523 Both initial values of the offsets and their final value computed by
1524 the function by incrementing the initial value by the size are
1525 validated. Return true if the offsets are not valid and a diagnostic
1529 maybe_diag_offset_bounds (location_t loc
, gcall
*call
, tree func
, int strict
,
1530 tree expr
, const builtin_memref
&ref
)
1532 if (!warn_array_bounds
)
1535 offset_int ooboff
[] = { ref
.offrange
[0], ref
.offrange
[1] };
1536 tree oobref
= ref
.offset_out_of_bounds (strict
, ooboff
);
1540 if (EXPR_HAS_LOCATION (expr
))
1541 loc
= EXPR_LOCATION (expr
);
1543 loc
= expansion_point_location_if_in_system_header (loc
);
1547 char rangestr
[2][64];
1548 if (ooboff
[0] == ooboff
[1]
1549 || (ooboff
[0] != ref
.offrange
[0]
1550 && ooboff
[0].to_shwi () >= ooboff
[1].to_shwi ()))
1551 sprintf (rangestr
[0], "%lli", (long long) ooboff
[0].to_shwi ());
1553 sprintf (rangestr
[0], "[%lli, %lli]",
1554 (long long) ooboff
[0].to_shwi (),
1555 (long long) ooboff
[1].to_shwi ());
1557 if (oobref
== error_mark_node
)
1559 if (ref
.sizrange
[0] == ref
.sizrange
[1])
1560 sprintf (rangestr
[1], "%lli", (long long) ref
.sizrange
[0].to_shwi ());
1562 sprintf (rangestr
[1], "[%lli, %lli]",
1563 (long long) ref
.sizrange
[0].to_shwi (),
1564 (long long) ref
.sizrange
[1].to_shwi ());
1566 if (DECL_P (ref
.base
)
1567 && TREE_CODE (type
= TREE_TYPE (ref
.base
)) == ARRAY_TYPE
)
1569 if (warning_at (loc
, OPT_Warray_bounds
,
1570 "%G%qD pointer overflow between offset %s "
1571 "and size %s accessing array %qD with type %qT",
1572 call
, func
, rangestr
[0], rangestr
[1], ref
.base
, type
))
1573 inform (DECL_SOURCE_LOCATION (ref
.base
),
1574 "array %qD declared here", ref
.base
);
1576 warning_at (loc
, OPT_Warray_bounds
,
1577 "%G%qD pointer overflow between offset %s "
1579 call
, func
, rangestr
[0], rangestr
[1]);
1582 warning_at (loc
, OPT_Warray_bounds
,
1583 "%G%qD pointer overflow between offset %s "
1585 call
, func
, rangestr
[0], rangestr
[1]);
1587 else if (oobref
== ref
.base
)
1589 const offset_int maxobjsize
= tree_to_shwi (max_object_size ());
1591 /* True when the offset formed by an access to the reference
1592 is out of bounds, rather than the initial offset wich is
1593 in bounds. This implies access past the end. */
1594 bool form
= ooboff
[0] != ref
.offrange
[0];
1596 if (DECL_P (ref
.base
))
1598 if ((ref
.basesize
< maxobjsize
1599 && warning_at (loc
, OPT_Warray_bounds
,
1601 ? G_("%G%qD forming offset %s is out of "
1602 "the bounds [0, %wu] of object %qD with "
1604 : G_("%G%qD offset %s is out of the bounds "
1605 "[0, %wu] of object %qD with type %qT"),
1606 call
, func
, rangestr
[0], ref
.basesize
.to_uhwi (),
1607 ref
.base
, TREE_TYPE (ref
.base
)))
1608 || warning_at (loc
, OPT_Warray_bounds
,
1610 ? G_("%G%qD forming offset %s is out of "
1611 "the bounds of object %qD with type %qT")
1612 : G_("%G%qD offset %s is out of the bounds "
1613 "of object %qD with type %qT"),
1614 call
, func
, rangestr
[0],
1615 ref
.base
, TREE_TYPE (ref
.base
)))
1616 inform (DECL_SOURCE_LOCATION (ref
.base
),
1617 "%qD declared here", ref
.base
);
1619 else if (ref
.basesize
< maxobjsize
)
1620 warning_at (loc
, OPT_Warray_bounds
,
1622 ? G_("%G%qD forming offset %s is out of the bounds "
1624 : G_("%G%qD offset %s is out of the bounds [0, %wu]"),
1625 call
, func
, rangestr
[0], ref
.basesize
.to_uhwi ());
1627 warning_at (loc
, OPT_Warray_bounds
,
1629 ? G_("%G%qD forming offset %s is out of bounds")
1630 : G_("%G%qD offset %s is out of bounds"),
1631 call
, func
, rangestr
[0]);
1633 else if (TREE_CODE (ref
.ref
) == MEM_REF
)
1635 tree type
= TREE_TYPE (TREE_OPERAND (ref
.ref
, 0));
1636 if (POINTER_TYPE_P (type
))
1637 type
= TREE_TYPE (type
);
1638 type
= TYPE_MAIN_VARIANT (type
);
1640 warning_at (loc
, OPT_Warray_bounds
,
1641 "%G%qD offset %s from the object at %qE is out "
1642 "of the bounds of %qT",
1643 call
, func
, rangestr
[0], ref
.base
, type
);
1647 type
= TYPE_MAIN_VARIANT (TREE_TYPE (ref
.ref
));
1649 warning_at (loc
, OPT_Warray_bounds
,
1650 "%G%qD offset %s from the object at %qE is out "
1651 "of the bounds of referenced subobject %qD with type %qT "
1653 call
, func
, rangestr
[0], ref
.base
, TREE_OPERAND (ref
.ref
, 1),
1654 type
, ref
.refoff
.to_uhwi ());
1660 /* Check a CALL statement for restrict-violations and issue warnings
1661 if/when appropriate. */
1664 wrestrict_dom_walker::check_call (gcall
*call
)
1666 /* Avoid checking the call if it has already been diagnosed for
1668 if (gimple_no_warning_p (call
))
1671 tree func
= gimple_call_fndecl (call
);
1672 if (!func
|| DECL_BUILT_IN_CLASS (func
) != BUILT_IN_NORMAL
)
1675 bool with_bounds
= gimple_call_with_bounds_p (call
);
1677 /* Argument number to extract from the call (depends on the built-in
1679 unsigned dst_idx
= -1;
1680 unsigned src_idx
= -1;
1681 unsigned bnd_idx
= -1;
1683 /* Is this CALL to a string function (as opposed to one to a raw
1684 memory function). */
1687 switch (DECL_FUNCTION_CODE (func
))
1689 case BUILT_IN_MEMCPY
:
1690 case BUILT_IN_MEMCPY_CHK
:
1691 case BUILT_IN_MEMCPY_CHKP
:
1692 case BUILT_IN_MEMCPY_CHK_CHKP
:
1693 case BUILT_IN_MEMPCPY
:
1694 case BUILT_IN_MEMPCPY_CHK
:
1695 case BUILT_IN_MEMPCPY_CHKP
:
1696 case BUILT_IN_MEMPCPY_CHK_CHKP
:
1697 case BUILT_IN_MEMMOVE
:
1698 case BUILT_IN_MEMMOVE_CHK
:
1699 case BUILT_IN_MEMMOVE_CHKP
:
1700 case BUILT_IN_MEMMOVE_CHK_CHKP
:
1704 case BUILT_IN_STPNCPY
:
1705 case BUILT_IN_STPNCPY_CHK
:
1706 case BUILT_IN_STRNCAT
:
1707 case BUILT_IN_STRNCAT_CHK
:
1708 case BUILT_IN_STRNCPY
:
1709 case BUILT_IN_STRNCPY_CHK
:
1711 src_idx
= 1 + with_bounds
;
1712 bnd_idx
= 2 + 2 * with_bounds
;
1715 case BUILT_IN_STPCPY
:
1716 case BUILT_IN_STPCPY_CHK
:
1717 case BUILT_IN_STPCPY_CHKP
:
1718 case BUILT_IN_STPCPY_CHK_CHKP
:
1719 case BUILT_IN_STRCPY
:
1720 case BUILT_IN_STRCPY_CHK
:
1721 case BUILT_IN_STRCPY_CHKP
:
1722 case BUILT_IN_STRCPY_CHK_CHKP
:
1723 case BUILT_IN_STRCAT
:
1724 case BUILT_IN_STRCAT_CHK
:
1725 case BUILT_IN_STRCAT_CHKP
:
1726 case BUILT_IN_STRCAT_CHK_CHKP
:
1728 src_idx
= 1 + with_bounds
;
1732 /* Handle other string functions here whose access may need
1733 to be validated for in-bounds offsets and non-overlapping
1734 copies. (Not all _chkp functions have BUILT_IN_XXX_CHKP
1735 macros so they need to be handled here.) */
1739 unsigned nargs
= gimple_call_num_args (call
);
1741 tree dst
= dst_idx
< nargs
? gimple_call_arg (call
, dst_idx
) : NULL_TREE
;
1742 tree src
= src_idx
< nargs
? gimple_call_arg (call
, src_idx
) : NULL_TREE
;
1743 tree dstwr
= bnd_idx
< nargs
? gimple_call_arg (call
, bnd_idx
) : NULL_TREE
;
1745 /* For string functions with an unspecified or unknown bound,
1746 assume the size of the access is one. */
1747 if (!dstwr
&& strfun
)
1748 dstwr
= size_one_node
;
1750 /* DST and SRC can be null for a call with an insufficient number
1751 of arguments to a built-in function declared without a protype. */
1755 /* DST, SRC, or DSTWR can also have the wrong type in a call to
1756 a function declared without a prototype. Avoid checking such
1758 if (TREE_CODE (TREE_TYPE (dst
)) != POINTER_TYPE
1759 || TREE_CODE (TREE_TYPE (src
)) != POINTER_TYPE
1760 || (dstwr
&& !INTEGRAL_TYPE_P (TREE_TYPE (dstwr
))))
1763 if (check_bounds_or_overlap (call
, dst
, src
, dstwr
, NULL_TREE
))
1766 /* Avoid diagnosing the call again. */
1767 gimple_set_no_warning (call
, true);
1770 } /* anonymous namespace */
1772 /* Attempt to detect and diagnose invalid offset bounds and (except for
1773 memmove) overlapping copy in a call expression EXPR from SRC to DST
1774 and DSTSIZE and SRCSIZE bytes, respectively. Both DSTSIZE and
1775 SRCSIZE may be NULL. Return false when one or the other has been
1776 detected and diagnosed, true otherwise. */
1779 check_bounds_or_overlap (gcall
*call
, tree dst
, tree src
, tree dstsize
,
1780 tree srcsize
, bool bounds_only
/* = false */)
1782 location_t loc
= gimple_location (call
);
1784 if (tree block
= gimple_block (call
))
1785 if (location_t
*pbloc
= block_nonartificial_location (block
))
1788 loc
= expansion_point_location_if_in_system_header (loc
);
1790 tree func
= gimple_call_fndecl (call
);
1792 builtin_memref
dstref (dst
, dstsize
);
1793 builtin_memref
srcref (src
, srcsize
);
1795 builtin_access
acs (call
, dstref
, srcref
);
1797 /* Set STRICT to the value of the -Warray-bounds=N argument for
1798 string functions or when N > 1. */
1799 int strict
= (acs
.strict () || warn_array_bounds
> 1 ? warn_array_bounds
: 0);
1801 /* Validate offsets first to make sure they are within the bounds
1802 of the destination object if its size is known, or PTRDIFF_MAX
1804 if (maybe_diag_offset_bounds (loc
, call
, func
, strict
, dst
, dstref
)
1805 || maybe_diag_offset_bounds (loc
, call
, func
, strict
, src
, srcref
))
1807 gimple_set_no_warning (call
, true);
1814 || (DECL_FUNCTION_CODE (func
) != BUILT_IN_MEMMOVE
1815 && DECL_FUNCTION_CODE (func
) != BUILT_IN_MEMMOVE_CHK
)));
1820 if (operand_equal_p (dst
, src
, 0))
1822 warning_at (loc
, OPT_Wrestrict
,
1823 "%G%qD source argument is the same as destination",
1825 gimple_set_no_warning (call
, true);
1829 /* Return false when overlap has been detected. */
1830 if (maybe_diag_overlap (loc
, call
, acs
))
1832 gimple_set_no_warning (call
, true);
1840 make_pass_warn_restrict (gcc::context
*ctxt
)
1842 return new pass_wrestrict (ctxt
);