1 /* Pass to detect and issue warnings for invalid accesses, including
2 invalid or mismatched allocation/deallocation calls.
4 Copyright (C) 2020-2023 Free Software Foundation, Inc.
5 Contributed by Martin Sebor <msebor@redhat.com>.
7 This file is part of GCC.
9 GCC is free software; you can redistribute it and/or modify it under
10 the terms of the GNU General Public License as published by the Free
11 Software Foundation; either version 3, or (at your option) any later
14 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
15 WARRANTY; without even the implied warranty of MERCHANTABILITY or
16 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
19 You should have received a copy of the GNU General Public License
20 along with GCC; see the file COPYING3. If not see
21 <http://www.gnu.org/licenses/>. */
23 #define INCLUDE_STRING
26 #include "coretypes.h"
30 #include "tree-pass.h"
32 #include "diagnostic.h"
34 #include "gimple-pretty-print.h"
35 #include "gimple-ssa-warn-access.h"
36 #include "gimple-ssa-warn-restrict.h"
37 #include "diagnostic-core.h"
38 #include "fold-const.h"
39 #include "gimple-iterator.h"
40 #include "gimple-fold.h"
41 #include "langhooks.h"
47 #include "tree-object-size.h"
48 #include "tree-ssa-strlen.h"
52 #include "gimple-range.h"
53 #include "stringpool.h"
56 #include "attr-fnspec.h"
57 #include "pointer-query.h"
59 /* Return true if tree node X has an associated location. */
61 static inline location_t
62 has_location (const_tree x
)
65 return DECL_SOURCE_LOCATION (x
) != UNKNOWN_LOCATION
;
68 return EXPR_HAS_LOCATION (x
);
73 /* Return the associated location of STMT. */
75 static inline location_t
76 get_location (const gimple
*stmt
)
78 return gimple_location (stmt
);
81 /* Return the associated location of tree node X. */
83 static inline location_t
87 return DECL_SOURCE_LOCATION (x
);
90 return EXPR_LOCATION (x
);
92 return UNKNOWN_LOCATION
;
95 /* Overload of the nascent tree function for GIMPLE STMT. */
98 get_callee_fndecl (const gimple
*stmt
)
100 return gimple_call_fndecl (stmt
);
103 static inline unsigned
104 call_nargs (const gimple
*stmt
)
106 return gimple_call_num_args (stmt
);
109 static inline unsigned
110 call_nargs (const_tree expr
)
112 return call_expr_nargs (expr
);
117 call_arg (const gimple
*stmt
, unsigned argno
)
119 return gimple_call_arg (stmt
, argno
);
123 call_arg (tree expr
, unsigned argno
)
125 return CALL_EXPR_ARG (expr
, argno
);
128 /* For a call EXPR at LOC to a function FNAME that expects a string
129 in the argument ARG, issue a diagnostic due to it being a called
130 with an argument that is a character array with no terminating
131 NUL. SIZE is the EXACT size of the array, and BNDRNG the number
132 of characters in which the NUL is expected. Either EXPR or FNAME
133 may be null but noth both. SIZE may be null when BNDRNG is null. */
135 template <class GimpleOrTree
>
137 warn_string_no_nul (location_t loc
, GimpleOrTree expr
, const char *fname
,
138 tree arg
, tree decl
, tree size
, bool exact
,
139 const wide_int bndrng
[2] /* = NULL */)
141 const opt_code opt
= OPT_Wstringop_overread
;
142 if ((expr
&& warning_suppressed_p (expr
, opt
))
143 || warning_suppressed_p (arg
, opt
))
146 loc
= expansion_point_location_if_in_system_header (loc
);
149 /* Format the bound range as a string to keep the number of messages
155 if (bndrng
[0] == bndrng
[1])
156 sprintf (bndstr
, "%llu", (unsigned long long) bndrng
[0].to_uhwi ());
158 sprintf (bndstr
, "[%llu, %llu]",
159 (unsigned long long) bndrng
[0].to_uhwi (),
160 (unsigned long long) bndrng
[1].to_uhwi ());
163 auto_diagnostic_group d
;
165 const tree maxobjsize
= max_object_size ();
166 const wide_int maxsiz
= wi::to_wide (maxobjsize
);
169 tree func
= get_callee_fndecl (expr
);
172 if (wi::ltu_p (maxsiz
, bndrng
[0]))
173 warned
= warning_at (loc
, opt
,
174 "%qD specified bound %s exceeds "
175 "maximum object size %E",
176 func
, bndstr
, maxobjsize
);
179 bool maybe
= wi::to_wide (size
) == bndrng
[0];
180 warned
= warning_at (loc
, opt
,
182 ? G_("%qD specified bound %s exceeds "
183 "the size %E of unterminated array")
185 ? G_("%qD specified bound %s may "
186 "exceed the size of at most %E "
187 "of unterminated array")
188 : G_("%qD specified bound %s exceeds "
189 "the size of at most %E "
190 "of unterminated array")),
195 warned
= warning_at (loc
, opt
,
196 "%qD argument missing terminating nul",
203 if (wi::ltu_p (maxsiz
, bndrng
[0]))
204 warned
= warning_at (loc
, opt
,
205 "%qs specified bound %s exceeds "
206 "maximum object size %E",
207 fname
, bndstr
, maxobjsize
);
210 bool maybe
= wi::to_wide (size
) == bndrng
[0];
211 warned
= warning_at (loc
, opt
,
213 ? G_("%qs specified bound %s exceeds "
214 "the size %E of unterminated array")
216 ? G_("%qs specified bound %s may "
217 "exceed the size of at most %E "
218 "of unterminated array")
219 : G_("%qs specified bound %s exceeds "
220 "the size of at most %E "
221 "of unterminated array")),
222 fname
, bndstr
, size
);
226 warned
= warning_at (loc
, opt
,
227 "%qs argument missing terminating nul",
233 inform (get_location (decl
),
234 "referenced argument declared here");
235 suppress_warning (arg
, opt
);
237 suppress_warning (expr
, opt
);
242 warn_string_no_nul (location_t loc
, gimple
*stmt
, const char *fname
,
243 tree arg
, tree decl
, tree size
/* = NULL_TREE */,
244 bool exact
/* = false */,
245 const wide_int bndrng
[2] /* = NULL */)
247 return warn_string_no_nul
<gimple
*> (loc
, stmt
, fname
,
248 arg
, decl
, size
, exact
, bndrng
);
252 warn_string_no_nul (location_t loc
, tree expr
, const char *fname
,
253 tree arg
, tree decl
, tree size
/* = NULL_TREE */,
254 bool exact
/* = false */,
255 const wide_int bndrng
[2] /* = NULL */)
257 return warn_string_no_nul
<tree
> (loc
, expr
, fname
,
258 arg
, decl
, size
, exact
, bndrng
);
261 /* If EXP refers to an unterminated constant character array return
262 the declaration of the object of which the array is a member or
263 element and if SIZE is not null, set *SIZE to the size of
264 the unterminated array and set *EXACT if the size is exact or
265 clear it otherwise. Otherwise return null. */
268 unterminated_array (tree exp
, tree
*size
/* = NULL */, bool *exact
/* = NULL */)
270 /* C_STRLEN will return NULL and set DECL in the info
271 structure if EXP references a unterminated array. */
272 c_strlen_data lendata
= { };
273 tree len
= c_strlen (exp
, 1, &lendata
);
274 if (len
|| !lendata
.minlen
|| !lendata
.decl
)
280 len
= lendata
.minlen
;
283 /* Constant offsets are already accounted for in LENDATA.MINLEN,
284 but not in a SSA_NAME + CST expression. */
285 if (TREE_CODE (lendata
.off
) == INTEGER_CST
)
287 else if (TREE_CODE (lendata
.off
) == PLUS_EXPR
288 && TREE_CODE (TREE_OPERAND (lendata
.off
, 1)) == INTEGER_CST
)
290 /* Subtract the offset from the size of the array. */
292 tree temp
= TREE_OPERAND (lendata
.off
, 1);
293 temp
= fold_convert (ssizetype
, temp
);
294 len
= fold_build2 (MINUS_EXPR
, ssizetype
, len
, temp
);
306 /* For a call EXPR (which may be null) that expects a string argument
307 SRC as an argument, returns false if SRC is a character array with
308 no terminating NUL. When nonnull, BOUND is the number of characters
309 in which to expect the terminating NUL. When EXPR is nonnull also
312 template <class GimpleOrTree
>
314 check_nul_terminated_array (GimpleOrTree expr
, tree src
, tree bound
)
316 /* The constant size of the array SRC points to. The actual size
317 may be less of EXACT is true, but not more. */
319 /* True if SRC involves a non-constant offset into the array. */
321 /* The unterminated constant array SRC points to. */
322 tree nonstr
= unterminated_array (src
, &size
, &exact
);
326 /* NONSTR refers to the non-nul terminated constant array and SIZE
327 is the constant size of the array in bytes. EXACT is true when
333 Value_Range
r (TREE_TYPE (bound
));
335 get_global_range_query ()->range_of_expr (r
, bound
);
337 if (r
.undefined_p () || r
.varying_p ())
340 bndrng
[0] = r
.lower_bound ();
341 bndrng
[1] = r
.upper_bound ();
345 if (wi::leu_p (bndrng
[0], wi::to_wide (size
)))
348 else if (wi::lt_p (bndrng
[0], wi::to_wide (size
), UNSIGNED
))
353 warn_string_no_nul (get_location (expr
), expr
, NULL
, src
, nonstr
,
354 size
, exact
, bound
? bndrng
: NULL
);
360 check_nul_terminated_array (gimple
*stmt
, tree src
, tree bound
/* = NULL_TREE */)
362 return check_nul_terminated_array
<gimple
*>(stmt
, src
, bound
);
366 check_nul_terminated_array (tree expr
, tree src
, tree bound
/* = NULL_TREE */)
368 return check_nul_terminated_array
<tree
>(expr
, src
, bound
);
371 /* Warn about passing a non-string array/pointer to a built-in function
372 that expects a nul-terminated string argument. Returns true if
373 a warning has been issued.*/
375 template <class GimpleOrTree
>
377 maybe_warn_nonstring_arg (tree fndecl
, GimpleOrTree exp
)
379 if (!fndecl
|| !fndecl_built_in_p (fndecl
, BUILT_IN_NORMAL
))
382 if (!warn_stringop_overread
383 || warning_suppressed_p (exp
, OPT_Wstringop_overread
))
386 /* Avoid clearly invalid calls (more checking done below). */
387 unsigned nargs
= call_nargs (exp
);
391 /* The bound argument to a bounded string function like strncpy. */
392 tree bound
= NULL_TREE
;
394 /* The longest known or possible string argument to one of the comparison
395 functions. If the length is less than the bound it is used instead.
396 Since the length is only used for warning and not for code generation
397 disable strict mode in the calls to get_range_strlen below. */
398 tree maxlen
= NULL_TREE
;
400 /* It's safe to call "bounded" string functions with a non-string
401 argument since the functions provide an explicit bound for this
402 purpose. The exception is strncat where the bound may refer to
403 either the destination or the source. */
404 int fncode
= DECL_FUNCTION_CODE (fndecl
);
407 case BUILT_IN_STRCMP
:
408 case BUILT_IN_STRNCMP
:
409 case BUILT_IN_STRNCASECMP
:
411 /* For these, if one argument refers to one or more of a set
412 of string constants or arrays of known size, determine
413 the range of their known or possible lengths and use it
414 conservatively as the bound for the unbounded function,
415 and to adjust the range of the bound of the bounded ones. */
416 for (unsigned argno
= 0;
417 argno
< MIN (nargs
, 2)
418 && !(maxlen
&& TREE_CODE (maxlen
) == INTEGER_CST
); argno
++)
420 tree arg
= call_arg (exp
, argno
);
421 if (!get_attr_nonstring_decl (arg
))
423 c_strlen_data lendata
= { };
424 /* Set MAXBOUND to an arbitrary non-null non-integer
425 node as a request to have it set to the length of
426 the longest string in a PHI. */
427 lendata
.maxbound
= arg
;
428 get_range_strlen (arg
, &lendata
, /* eltsize = */ 1);
429 maxlen
= lendata
.maxbound
;
435 case BUILT_IN_STRNCAT
:
436 case BUILT_IN_STPNCPY
:
437 case BUILT_IN_STRNCPY
:
439 bound
= call_arg (exp
, 2);
442 case BUILT_IN_STRNDUP
:
445 bound
= call_arg (exp
, 1);
448 case BUILT_IN_STRNLEN
:
450 tree arg
= call_arg (exp
, 0);
451 if (!get_attr_nonstring_decl (arg
))
453 c_strlen_data lendata
= { };
454 /* Set MAXBOUND to an arbitrary non-null non-integer
455 node as a request to have it set to the length of
456 the longest string in a PHI. */
457 lendata
.maxbound
= arg
;
458 get_range_strlen (arg
, &lendata
, /* eltsize = */ 1);
459 maxlen
= lendata
.maxbound
;
462 bound
= call_arg (exp
, 1);
470 /* Determine the range of the bound argument (if specified). */
471 tree bndrng
[2] = { NULL_TREE
, NULL_TREE
};
475 get_size_range (bound
, bndrng
);
478 location_t loc
= get_location (exp
);
482 /* Diagnose excessive bound prior to the adjustment below and
483 regardless of attribute nonstring. */
484 tree maxobjsize
= max_object_size ();
485 if (tree_int_cst_lt (maxobjsize
, bndrng
[0]))
488 if (tree_int_cst_equal (bndrng
[0], bndrng
[1]))
489 warned
= warning_at (loc
, OPT_Wstringop_overread
,
490 "%qD specified bound %E "
491 "exceeds maximum object size %E",
492 fndecl
, bndrng
[0], maxobjsize
);
494 warned
= warning_at (loc
, OPT_Wstringop_overread
,
495 "%qD specified bound [%E, %E] "
496 "exceeds maximum object size %E",
497 fndecl
, bndrng
[0], bndrng
[1],
500 suppress_warning (exp
, OPT_Wstringop_overread
);
506 if (maxlen
&& !integer_all_onesp (maxlen
))
508 /* Add one for the nul. */
509 maxlen
= const_binop (PLUS_EXPR
, TREE_TYPE (maxlen
), maxlen
,
514 /* Conservatively use the upper bound of the lengths for
515 both the lower and the upper bound of the operation. */
518 bound
= void_type_node
;
522 /* Replace the bound on the operation with the upper bound
523 of the length of the string if the latter is smaller. */
524 if (tree_int_cst_lt (maxlen
, bndrng
[0]))
526 else if (tree_int_cst_lt (maxlen
, bndrng
[1]))
531 bool any_arg_warned
= false;
532 /* Iterate over the built-in function's formal arguments and check
533 each const char* against the actual argument. If the actual
534 argument is declared attribute non-string issue a warning unless
535 the argument's maximum length is bounded. */
536 function_args_iterator it
;
537 function_args_iter_init (&it
, TREE_TYPE (fndecl
));
539 for (unsigned argno
= 0; ; ++argno
, function_args_iter_next (&it
))
541 /* Avoid iterating past the declared argument in a call
542 to function declared without a prototype. */
546 tree argtype
= function_args_iter_cond (&it
);
550 if (TREE_CODE (argtype
) != POINTER_TYPE
)
553 argtype
= TREE_TYPE (argtype
);
555 if (TREE_CODE (argtype
) != INTEGER_TYPE
556 || !TYPE_READONLY (argtype
))
559 argtype
= TYPE_MAIN_VARIANT (argtype
);
560 if (argtype
!= char_type_node
)
563 tree callarg
= call_arg (exp
, argno
);
564 if (TREE_CODE (callarg
) == ADDR_EXPR
)
565 callarg
= TREE_OPERAND (callarg
, 0);
567 /* See if the destination is declared with attribute "nonstring". */
568 tree decl
= get_attr_nonstring_decl (callarg
);
572 /* The maximum number of array elements accessed. */
573 offset_int wibnd
= 0;
575 if (argno
&& fncode
== BUILT_IN_STRNCAT
)
577 /* See if the bound in strncat is derived from the length
578 of the strlen of the destination (as it's expected to be).
579 If so, reset BOUND and FNCODE to trigger a warning. */
580 tree dstarg
= call_arg (exp
, 0);
581 if (is_strlen_related_p (dstarg
, bound
))
583 /* The bound applies to the destination, not to the source,
584 so reset these to trigger a warning without mentioning
590 /* Use the upper bound of the range for strncat. */
591 wibnd
= wi::to_offset (bndrng
[1]);
594 /* Use the lower bound of the range for functions other than
596 wibnd
= wi::to_offset (bndrng
[0]);
598 /* Determine the size of the argument array if it is one. */
599 offset_int asize
= wibnd
;
600 bool known_size
= false;
601 tree type
= TREE_TYPE (decl
);
603 /* Determine the array size. For arrays of unknown bound and
604 pointers reset BOUND to trigger the appropriate warning. */
605 if (TREE_CODE (type
) == ARRAY_TYPE
)
607 if (tree arrbnd
= TYPE_DOMAIN (type
))
609 if ((arrbnd
= TYPE_MAX_VALUE (arrbnd
)))
611 asize
= wi::to_offset (arrbnd
) + 1;
615 else if (bound
== void_type_node
)
618 else if (bound
== void_type_node
)
621 /* In a call to strncat with a bound in a range whose lower but
622 not upper bound is less than the array size, reset ASIZE to
623 be the same as the bound and the other variable to trigger
624 the appropriate warning below. */
625 if (fncode
== BUILT_IN_STRNCAT
626 && bndrng
[0] != bndrng
[1]
627 && wi::ltu_p (wi::to_offset (bndrng
[0]), asize
)
629 || wi::ltu_p (asize
, wibnd
)))
638 auto_diagnostic_group d
;
639 if (wi::ltu_p (asize
, wibnd
))
641 if (bndrng
[0] == bndrng
[1])
642 warned
= warning_at (loc
, OPT_Wstringop_overread
,
643 "%qD argument %i declared attribute "
644 "%<nonstring%> is smaller than the specified "
646 fndecl
, argno
+ 1, wibnd
.to_uhwi ());
647 else if (wi::ltu_p (asize
, wi::to_offset (bndrng
[0])))
648 warned
= warning_at (loc
, OPT_Wstringop_overread
,
649 "%qD argument %i declared attribute "
650 "%<nonstring%> is smaller than "
651 "the specified bound [%E, %E]",
652 fndecl
, argno
+ 1, bndrng
[0], bndrng
[1]);
654 warned
= warning_at (loc
, OPT_Wstringop_overread
,
655 "%qD argument %i declared attribute "
656 "%<nonstring%> may be smaller than "
657 "the specified bound [%E, %E]",
658 fndecl
, argno
+ 1, bndrng
[0], bndrng
[1]);
660 else if (fncode
== BUILT_IN_STRNCAT
)
661 ; /* Avoid warning for calls to strncat() when the bound
662 is equal to the size of the non-string argument. */
664 warned
= warning_at (loc
, OPT_Wstringop_overread
,
665 "%qD argument %i declared attribute %<nonstring%>",
670 inform (DECL_SOURCE_LOCATION (decl
),
671 "argument %qD declared here", decl
);
672 any_arg_warned
= true;
677 suppress_warning (exp
, OPT_Wstringop_overread
);
679 return any_arg_warned
;
683 maybe_warn_nonstring_arg (tree fndecl
, gimple
*stmt
)
685 return maybe_warn_nonstring_arg
<gimple
*>(fndecl
, stmt
);
690 maybe_warn_nonstring_arg (tree fndecl
, tree expr
)
692 return maybe_warn_nonstring_arg
<tree
>(fndecl
, expr
);
695 /* Issue a warning OPT for a bounded call EXP with a bound in RANGE
696 accessing an object with SIZE. */
698 template <class GimpleOrTree
>
700 maybe_warn_for_bound (opt_code opt
, location_t loc
, GimpleOrTree exp
, tree func
,
701 tree bndrng
[2], tree size
, const access_data
*pad
)
703 if (!bndrng
[0] || warning_suppressed_p (exp
, opt
))
706 tree maxobjsize
= max_object_size ();
710 if (opt
== OPT_Wstringop_overread
)
712 bool maybe
= pad
&& pad
->src
.phi ();
715 /* Issue a "maybe" warning only if the PHI refers to objects
716 at least one of which has more space remaining than the bound.
717 Otherwise, if the bound is greater, use the definitive form. */
718 offset_int remmax
= pad
->src
.size_remaining ();
719 if (remmax
< wi::to_offset (bndrng
[0]))
723 auto_diagnostic_group d
;
724 if (tree_int_cst_lt (maxobjsize
, bndrng
[0]))
726 if (bndrng
[0] == bndrng
[1])
728 ? warning_at (loc
, opt
,
730 ? G_("%qD specified bound %E may "
731 "exceed maximum object size %E")
732 : G_("%qD specified bound %E "
733 "exceeds maximum object size %E")),
734 func
, bndrng
[0], maxobjsize
)
735 : warning_at (loc
, opt
,
737 ? G_("specified bound %E may "
738 "exceed maximum object size %E")
739 : G_("specified bound %E "
740 "exceeds maximum object size %E")),
741 bndrng
[0], maxobjsize
));
744 ? warning_at (loc
, opt
,
746 ? G_("%qD specified bound [%E, %E] may "
747 "exceed maximum object size %E")
748 : G_("%qD specified bound [%E, %E] "
749 "exceeds maximum object size %E")),
751 bndrng
[0], bndrng
[1], maxobjsize
)
752 : warning_at (loc
, opt
,
754 ? G_("specified bound [%E, %E] may "
755 "exceed maximum object size %E")
756 : G_("specified bound [%E, %E] "
757 "exceeds maximum object size %E")),
758 bndrng
[0], bndrng
[1], maxobjsize
));
760 else if (!size
|| tree_int_cst_le (bndrng
[0], size
))
762 else if (tree_int_cst_equal (bndrng
[0], bndrng
[1]))
764 ? warning_at (loc
, opt
,
766 ? G_("%qD specified bound %E may exceed "
768 : G_("%qD specified bound %E exceeds "
770 func
, bndrng
[0], size
)
771 : warning_at (loc
, opt
,
773 ? G_("specified bound %E may exceed "
775 : G_("specified bound %E exceeds "
780 ? warning_at (loc
, opt
,
782 ? G_("%qD specified bound [%E, %E] may "
783 "exceed source size %E")
784 : G_("%qD specified bound [%E, %E] exceeds "
786 func
, bndrng
[0], bndrng
[1], size
)
787 : warning_at (loc
, opt
,
789 ? G_("specified bound [%E, %E] may exceed "
791 : G_("specified bound [%E, %E] exceeds "
793 bndrng
[0], bndrng
[1], size
));
796 if (pad
&& pad
->src
.ref
797 && has_location (pad
->src
.ref
))
798 inform (get_location (pad
->src
.ref
),
799 "source object allocated here");
800 suppress_warning (exp
, opt
);
806 bool maybe
= pad
&& pad
->dst
.phi ();
809 /* Issue a "maybe" warning only if the PHI refers to objects
810 at least one of which has more space remaining than the bound.
811 Otherwise, if the bound is greater, use the definitive form. */
812 offset_int remmax
= pad
->dst
.size_remaining ();
813 if (remmax
< wi::to_offset (bndrng
[0]))
816 if (tree_int_cst_lt (maxobjsize
, bndrng
[0]))
818 if (bndrng
[0] == bndrng
[1])
820 ? warning_at (loc
, opt
,
822 ? G_("%qD specified size %E may "
823 "exceed maximum object size %E")
824 : G_("%qD specified size %E "
825 "exceeds maximum object size %E")),
826 func
, bndrng
[0], maxobjsize
)
827 : warning_at (loc
, opt
,
829 ? G_("specified size %E may exceed "
830 "maximum object size %E")
831 : G_("specified size %E exceeds "
832 "maximum object size %E")),
833 bndrng
[0], maxobjsize
));
836 ? warning_at (loc
, opt
,
838 ? G_("%qD specified size between %E and %E "
839 "may exceed maximum object size %E")
840 : G_("%qD specified size between %E and %E "
841 "exceeds maximum object size %E")),
842 func
, bndrng
[0], bndrng
[1], maxobjsize
)
843 : warning_at (loc
, opt
,
845 ? G_("specified size between %E and %E "
846 "may exceed maximum object size %E")
847 : G_("specified size between %E and %E "
848 "exceeds maximum object size %E")),
849 bndrng
[0], bndrng
[1], maxobjsize
));
851 else if (!size
|| tree_int_cst_le (bndrng
[0], size
))
853 else if (tree_int_cst_equal (bndrng
[0], bndrng
[1]))
855 ? warning_at (loc
, opt
,
857 ? G_("%qD specified bound %E may exceed "
858 "destination size %E")
859 : G_("%qD specified bound %E exceeds "
860 "destination size %E")),
861 func
, bndrng
[0], size
)
862 : warning_at (loc
, opt
,
864 ? G_("specified bound %E may exceed "
865 "destination size %E")
866 : G_("specified bound %E exceeds "
867 "destination size %E")),
871 ? warning_at (loc
, opt
,
873 ? G_("%qD specified bound [%E, %E] may exceed "
874 "destination size %E")
875 : G_("%qD specified bound [%E, %E] exceeds "
876 "destination size %E")),
877 func
, bndrng
[0], bndrng
[1], size
)
878 : warning_at (loc
, opt
,
880 ? G_("specified bound [%E, %E] exceeds "
881 "destination size %E")
882 : G_("specified bound [%E, %E] exceeds "
883 "destination size %E")),
884 bndrng
[0], bndrng
[1], size
));
888 if (pad
&& pad
->dst
.ref
889 && has_location (pad
->dst
.ref
))
890 inform (get_location (pad
->dst
.ref
),
891 "destination object allocated here");
892 suppress_warning (exp
, opt
);
899 maybe_warn_for_bound (opt_code opt
, location_t loc
, gimple
*stmt
, tree func
,
900 tree bndrng
[2], tree size
,
901 const access_data
*pad
/* = NULL */)
903 return maybe_warn_for_bound
<gimple
*> (opt
, loc
, stmt
, func
, bndrng
, size
,
908 maybe_warn_for_bound (opt_code opt
, location_t loc
, tree expr
, tree func
,
909 tree bndrng
[2], tree size
,
910 const access_data
*pad
/* = NULL */)
912 return maybe_warn_for_bound
<tree
> (opt
, loc
, expr
, func
, bndrng
, size
, pad
);
915 /* For an expression EXP issue an access warning controlled by option OPT
916 with access to a region SIZE bytes in size in the RANGE of sizes.
917 WRITE is true for a write access, READ for a read access, neither for
918 call that may or may not perform an access but for which the range
919 is expected to valid.
920 Returns true when a warning has been issued. */
922 template <class GimpleOrTree
>
924 warn_for_access (location_t loc
, tree func
, GimpleOrTree exp
, int opt
,
925 tree range
[2], tree size
, bool write
, bool read
, bool maybe
)
931 if (tree_int_cst_equal (range
[0], range
[1]))
933 ? warning_n (loc
, opt
, tree_to_uhwi (range
[0]),
935 ? G_("%qD may access %E byte in a region "
937 : G_("%qD accessing %E byte in a region "
940 ? G_ ("%qD may access %E bytes in a region "
942 : G_ ("%qD accessing %E bytes in a region "
944 func
, range
[0], size
)
945 : warning_n (loc
, opt
, tree_to_uhwi (range
[0]),
947 ? G_("may access %E byte in a region "
949 : G_("accessing %E byte in a region "
952 ? G_("may access %E bytes in a region "
954 : G_("accessing %E bytes in a region "
957 else if (tree_int_cst_sign_bit (range
[1]))
959 /* Avoid printing the upper bound if it's invalid. */
961 ? warning_at (loc
, opt
,
963 ? G_("%qD may access %E or more bytes "
964 "in a region of size %E")
965 : G_("%qD accessing %E or more bytes "
966 "in a region of size %E")),
967 func
, range
[0], size
)
968 : warning_at (loc
, opt
,
970 ? G_("may access %E or more bytes "
971 "in a region of size %E")
972 : G_("accessing %E or more bytes "
973 "in a region of size %E")),
978 ? warning_at (loc
, opt
,
980 ? G_("%qD may access between %E and %E "
981 "bytes in a region of size %E")
982 : G_("%qD accessing between %E and %E "
983 "bytes in a region of size %E")),
984 func
, range
[0], range
[1], size
)
985 : warning_at (loc
, opt
,
987 ? G_("may access between %E and %E bytes "
988 "in a region of size %E")
989 : G_("accessing between %E and %E bytes "
990 "in a region of size %E")),
991 range
[0], range
[1], size
));
997 if (tree_int_cst_equal (range
[0], range
[1]))
999 ? warning_n (loc
, opt
, tree_to_uhwi (range
[0]),
1001 ? G_("%qD may write %E byte into a region "
1003 : G_("%qD writing %E byte into a region "
1004 "of size %E overflows the destination")),
1006 ? G_("%qD may write %E bytes into a region "
1008 : G_("%qD writing %E bytes into a region "
1009 "of size %E overflows the destination")),
1010 func
, range
[0], size
)
1011 : warning_n (loc
, opt
, tree_to_uhwi (range
[0]),
1013 ? G_("may write %E byte into a region "
1015 : G_("writing %E byte into a region "
1016 "of size %E overflows the destination")),
1018 ? G_("may write %E bytes into a region "
1020 : G_("writing %E bytes into a region "
1021 "of size %E overflows the destination")),
1023 else if (tree_int_cst_sign_bit (range
[1]))
1025 /* Avoid printing the upper bound if it's invalid. */
1027 ? warning_at (loc
, opt
,
1029 ? G_("%qD may write %E or more bytes "
1030 "into a region of size %E")
1031 : G_("%qD writing %E or more bytes "
1032 "into a region of size %E overflows "
1033 "the destination")),
1034 func
, range
[0], size
)
1035 : warning_at (loc
, opt
,
1037 ? G_("may write %E or more bytes into "
1038 "a region of size %E")
1039 : G_("writing %E or more bytes into "
1040 "a region of size %E overflows "
1041 "the destination")),
1046 ? warning_at (loc
, opt
,
1048 ? G_("%qD may write between %E and %E bytes "
1049 "into a region of size %E")
1050 : G_("%qD writing between %E and %E bytes "
1051 "into a region of size %E overflows "
1052 "the destination")),
1053 func
, range
[0], range
[1], size
)
1054 : warning_at (loc
, opt
,
1056 ? G_("may write between %E and %E bytes "
1057 "into a region of size %E")
1058 : G_("writing between %E and %E bytes "
1059 "into a region of size %E overflows "
1060 "the destination")),
1061 range
[0], range
[1], size
));
1067 if (tree_int_cst_equal (range
[0], range
[1]))
1069 ? warning_n (loc
, OPT_Wstringop_overread
,
1070 tree_to_uhwi (range
[0]),
1072 ? G_("%qD may read %E byte from a region "
1074 : G_("%qD reading %E byte from a region "
1077 ? G_("%qD may read %E bytes from a region "
1079 : G_("%qD reading %E bytes from a region "
1081 func
, range
[0], size
)
1082 : warning_n (loc
, OPT_Wstringop_overread
,
1083 tree_to_uhwi (range
[0]),
1085 ? G_("may read %E byte from a region "
1087 : G_("reading %E byte from a region "
1090 ? G_("may read %E bytes from a region "
1092 : G_("reading %E bytes from a region "
1095 else if (tree_int_cst_sign_bit (range
[1]))
1097 /* Avoid printing the upper bound if it's invalid. */
1099 ? warning_at (loc
, OPT_Wstringop_overread
,
1101 ? G_("%qD may read %E or more bytes "
1102 "from a region of size %E")
1103 : G_("%qD reading %E or more bytes "
1104 "from a region of size %E")),
1105 func
, range
[0], size
)
1106 : warning_at (loc
, OPT_Wstringop_overread
,
1108 ? G_("may read %E or more bytes "
1109 "from a region of size %E")
1110 : G_("reading %E or more bytes "
1111 "from a region of size %E")),
1116 ? warning_at (loc
, OPT_Wstringop_overread
,
1118 ? G_("%qD may read between %E and %E bytes "
1119 "from a region of size %E")
1120 : G_("%qD reading between %E and %E bytes "
1121 "from a region of size %E")),
1122 func
, range
[0], range
[1], size
)
1123 : warning_at (loc
, opt
,
1125 ? G_("may read between %E and %E bytes "
1126 "from a region of size %E")
1127 : G_("reading between %E and %E bytes "
1128 "from a region of size %E")),
1129 range
[0], range
[1], size
));
1132 suppress_warning (exp
, OPT_Wstringop_overread
);
1137 if (tree_int_cst_equal (range
[0], range
[1])
1138 || tree_int_cst_sign_bit (range
[1]))
1140 ? warning_n (loc
, OPT_Wstringop_overread
,
1141 tree_to_uhwi (range
[0]),
1142 "%qD expecting %E byte in a region of size %E",
1143 "%qD expecting %E bytes in a region of size %E",
1144 func
, range
[0], size
)
1145 : warning_n (loc
, OPT_Wstringop_overread
,
1146 tree_to_uhwi (range
[0]),
1147 "expecting %E byte in a region of size %E",
1148 "expecting %E bytes in a region of size %E",
1150 else if (tree_int_cst_sign_bit (range
[1]))
1152 /* Avoid printing the upper bound if it's invalid. */
1154 ? warning_at (loc
, OPT_Wstringop_overread
,
1155 "%qD expecting %E or more bytes in a region "
1157 func
, range
[0], size
)
1158 : warning_at (loc
, OPT_Wstringop_overread
,
1159 "expecting %E or more bytes in a region "
1165 ? warning_at (loc
, OPT_Wstringop_overread
,
1166 "%qD expecting between %E and %E bytes in "
1167 "a region of size %E",
1168 func
, range
[0], range
[1], size
)
1169 : warning_at (loc
, OPT_Wstringop_overread
,
1170 "expecting between %E and %E bytes in "
1171 "a region of size %E",
1172 range
[0], range
[1], size
));
1175 suppress_warning (exp
, OPT_Wstringop_overread
);
1181 warn_for_access (location_t loc
, tree func
, gimple
*stmt
, int opt
,
1182 tree range
[2], tree size
, bool write
, bool read
, bool maybe
)
1184 return warn_for_access
<gimple
*>(loc
, func
, stmt
, opt
, range
, size
,
1185 write
, read
, maybe
);
1189 warn_for_access (location_t loc
, tree func
, tree expr
, int opt
,
1190 tree range
[2], tree size
, bool write
, bool read
, bool maybe
)
1192 return warn_for_access
<tree
>(loc
, func
, expr
, opt
, range
, size
,
1193 write
, read
, maybe
);
1196 /* Helper to set RANGE to the range of BOUND if it's nonnull, bounded
1197 by BNDRNG if nonnull and valid. */
1200 get_size_range (range_query
*query
, tree bound
, gimple
*stmt
, tree range
[2],
1201 const offset_int bndrng
[2])
1204 get_size_range (query
, bound
, stmt
, range
);
1206 if (!bndrng
|| (bndrng
[0] == 0 && bndrng
[1] == HOST_WIDE_INT_M1U
))
1209 if (range
[0] && TREE_CODE (range
[0]) == INTEGER_CST
)
1212 { wi::to_offset (range
[0]), wi::to_offset (range
[1]) };
1213 if (r
[0] < bndrng
[0])
1214 range
[0] = wide_int_to_tree (sizetype
, bndrng
[0]);
1215 if (bndrng
[1] < r
[1])
1216 range
[1] = wide_int_to_tree (sizetype
, bndrng
[1]);
1220 range
[0] = wide_int_to_tree (sizetype
, bndrng
[0]);
1221 range
[1] = wide_int_to_tree (sizetype
, bndrng
[1]);
1225 /* Try to verify that the sizes and lengths of the arguments to a string
1226 manipulation function given by EXP are within valid bounds and that
1227 the operation does not lead to buffer overflow or read past the end.
1228 Arguments other than EXP may be null. When non-null, the arguments
1229 have the following meaning:
1230 DST is the destination of a copy call or NULL otherwise.
1231 SRC is the source of a copy call or NULL otherwise.
1232 DSTWRITE is the number of bytes written into the destination obtained
1233 from the user-supplied size argument to the function (such as in
1234 memcpy(DST, SRCs, DSTWRITE) or strncpy(DST, DRC, DSTWRITE).
1235 MAXREAD is the user-supplied bound on the length of the source sequence
1236 (such as in strncat(d, s, N). It specifies the upper limit on the number
1237 of bytes to write. If NULL, it's taken to be the same as DSTWRITE.
1238 SRCSTR is the source string (such as in strcpy(DST, SRC)) when the
1239 expression EXP is a string function call (as opposed to a memory call
1240 like memcpy). As an exception, SRCSTR can also be an integer denoting
1241 the precomputed size of the source string or object (for functions like
1243 DSTSIZE is the size of the destination object.
1245 When DSTWRITE is null LEN is checked to verify that it doesn't exceed
1248 WRITE is true for write accesses, READ is true for reads. Both are
1249 false for simple size checks in calls to functions that neither read
1250 from nor write to the region.
1252 When nonnull, PAD points to a more detailed description of the access.
1254 If the call is successfully verified as safe return true, otherwise
1257 template <class GimpleOrTree
>
1259 check_access (GimpleOrTree exp
, tree dstwrite
,
1260 tree maxread
, tree srcstr
, tree dstsize
,
1261 access_mode mode
, const access_data
*pad
,
1264 /* The size of the largest object is half the address space, or
1265 PTRDIFF_MAX. (This is way too permissive.) */
1266 tree maxobjsize
= max_object_size ();
1268 /* Either an approximate/minimum the length of the source string for
1269 string functions or the size of the source object for raw memory
1271 tree slen
= NULL_TREE
;
1273 /* The range of the access in bytes; first set to the write access
1274 for functions that write and then read for those that also (or
1276 tree range
[2] = { NULL_TREE
, NULL_TREE
};
1278 /* Set to true when the exact number of bytes written by a string
1279 function like strcpy is not known and the only thing that is
1280 known is that it must be at least one (for the terminating nul). */
1281 bool at_least_one
= false;
1284 /* SRCSTR is normally a pointer to string but as a special case
1285 it can be an integer denoting the length of a string. */
1286 if (POINTER_TYPE_P (TREE_TYPE (srcstr
)))
1288 if (!check_nul_terminated_array (exp
, srcstr
, maxread
))
1289 /* Return if the array is not nul-terminated and a warning
1293 /* Try to determine the range of lengths the source string
1294 refers to. If it can be determined and is less than
1295 the upper bound given by MAXREAD add one to it for
1296 the terminating nul. Otherwise, set it to one for
1297 the same reason, or to MAXREAD as appropriate. */
1298 c_strlen_data lendata
= { };
1299 get_range_strlen (srcstr
, &lendata
, /* eltsize = */ 1);
1300 range
[0] = lendata
.minlen
;
1301 range
[1] = lendata
.maxbound
? lendata
.maxbound
: lendata
.maxlen
;
1303 && TREE_CODE (range
[0]) == INTEGER_CST
1304 && TREE_CODE (range
[1]) == INTEGER_CST
1305 && (!maxread
|| TREE_CODE (maxread
) == INTEGER_CST
))
1307 if (maxread
&& tree_int_cst_le (maxread
, range
[0]))
1308 range
[0] = range
[1] = maxread
;
1310 range
[0] = fold_build2 (PLUS_EXPR
, size_type_node
,
1311 range
[0], size_one_node
);
1313 if (maxread
&& tree_int_cst_le (maxread
, range
[1]))
1315 else if (!integer_all_onesp (range
[1]))
1316 range
[1] = fold_build2 (PLUS_EXPR
, size_type_node
,
1317 range
[1], size_one_node
);
1323 at_least_one
= true;
1324 slen
= size_one_node
;
1331 if (!dstwrite
&& !maxread
)
1333 /* When the only available piece of data is the object size
1334 there is nothing to do. */
1338 /* Otherwise, when the length of the source sequence is known
1339 (as with strlen), set DSTWRITE to it. */
1345 dstsize
= maxobjsize
;
1347 /* Set RANGE to that of DSTWRITE if non-null, bounded by PAD->DST_BNDRNG
1349 gimple
*stmt
= pad
? pad
->stmt
: nullptr;
1350 get_size_range (rvals
, dstwrite
, stmt
, range
, pad
? pad
->dst_bndrng
: NULL
);
1352 tree func
= get_callee_fndecl (exp
);
1353 /* Read vs write access by built-ins can be determined from the const
1354 qualifiers on the pointer argument. In the absence of attribute
1355 access, non-const qualified pointer arguments to user-defined
1356 functions are assumed to both read and write the objects. */
1357 const bool builtin
= func
? fndecl_built_in_p (func
) : false;
1359 /* First check the number of bytes to be written against the maximum
1362 && TREE_CODE (range
[0]) == INTEGER_CST
1363 && tree_int_cst_lt (maxobjsize
, range
[0]))
1365 location_t loc
= get_location (exp
);
1366 maybe_warn_for_bound (OPT_Wstringop_overflow_
, loc
, exp
, func
, range
,
1371 /* The number of bytes to write is "exact" if DSTWRITE is non-null,
1372 constant, and in range of unsigned HOST_WIDE_INT. */
1373 bool exactwrite
= dstwrite
&& tree_fits_uhwi_p (dstwrite
);
1375 /* Next check the number of bytes to be written against the destination
1377 if (range
[0] || !exactwrite
|| integer_all_onesp (dstwrite
))
1380 && TREE_CODE (range
[0]) == INTEGER_CST
1381 && ((tree_fits_uhwi_p (dstsize
)
1382 && tree_int_cst_lt (dstsize
, range
[0]))
1384 && tree_fits_uhwi_p (dstwrite
)
1385 && tree_int_cst_lt (dstwrite
, range
[0]))))
1387 const opt_code opt
= OPT_Wstringop_overflow_
;
1388 if (warning_suppressed_p (exp
, opt
)
1389 || (pad
&& pad
->dst
.ref
1390 && warning_suppressed_p (pad
->dst
.ref
, opt
)))
1393 auto_diagnostic_group d
;
1394 location_t loc
= get_location (exp
);
1395 bool warned
= false;
1396 if (dstwrite
== slen
&& at_least_one
)
1398 /* This is a call to strcpy with a destination of 0 size
1399 and a source of unknown length. The call will write
1400 at least one byte past the end of the destination. */
1402 ? warning_at (loc
, opt
,
1403 "%qD writing %E or more bytes into "
1404 "a region of size %E overflows "
1406 func
, range
[0], dstsize
)
1407 : warning_at (loc
, opt
,
1408 "writing %E or more bytes into "
1409 "a region of size %E overflows "
1411 range
[0], dstsize
));
1416 = mode
== access_read_only
|| mode
== access_read_write
;
1418 = mode
== access_write_only
|| mode
== access_read_write
;
1419 const bool maybe
= pad
&& pad
->dst
.parmarray
;
1420 warned
= warn_for_access (loc
, func
, exp
,
1421 OPT_Wstringop_overflow_
,
1423 write
, read
&& !builtin
, maybe
);
1428 suppress_warning (exp
, OPT_Wstringop_overflow_
);
1430 pad
->dst
.inform_access (pad
->mode
);
1433 /* Return error when an overflow has been detected. */
1438 /* Check the maximum length of the source sequence against the size
1439 of the destination object if known, or against the maximum size
1443 /* Set RANGE to that of MAXREAD, bounded by PAD->SRC_BNDRNG if
1444 PAD is nonnull and BNDRNG is valid. */
1445 get_size_range (rvals
, maxread
, stmt
, range
, pad
? pad
->src_bndrng
: NULL
);
1447 location_t loc
= get_location (exp
);
1448 tree size
= dstsize
;
1449 if (pad
&& pad
->mode
== access_read_only
)
1450 size
= wide_int_to_tree (sizetype
, pad
->src
.size_remaining ());
1452 if (range
[0] && maxread
&& tree_fits_uhwi_p (size
))
1454 if (tree_int_cst_lt (maxobjsize
, range
[0]))
1456 maybe_warn_for_bound (OPT_Wstringop_overread
, loc
, exp
, func
,
1461 if (size
!= maxobjsize
&& tree_int_cst_lt (size
, range
[0]))
1463 opt_code opt
= (dstwrite
|| mode
!= access_read_only
1464 ? OPT_Wstringop_overflow_
1465 : OPT_Wstringop_overread
);
1466 maybe_warn_for_bound (opt
, loc
, exp
, func
, range
, size
, pad
);
1471 maybe_warn_nonstring_arg (func
, exp
);
1474 /* Check for reading past the end of SRC. */
1475 bool overread
= (slen
1479 && TREE_CODE (slen
) == INTEGER_CST
1480 && tree_int_cst_lt (slen
, range
[0]));
1481 /* If none is determined try to get a better answer based on the details
1485 && pad
->src
.sizrng
[1] >= 0
1486 && pad
->src
.offrng
[0] >= 0
1487 && (pad
->src
.offrng
[1] < 0
1488 || pad
->src
.offrng
[0] <= pad
->src
.offrng
[1]))
1490 /* Set RANGE to that of MAXREAD, bounded by PAD->SRC_BNDRNG if
1491 PAD is nonnull and BNDRNG is valid. */
1492 get_size_range (rvals
, maxread
, stmt
, range
, pad
? pad
->src_bndrng
: NULL
);
1493 /* Set OVERREAD for reads starting just past the end of an object. */
1494 overread
= pad
->src
.sizrng
[1] - pad
->src
.offrng
[0] < pad
->src_bndrng
[0];
1495 range
[0] = wide_int_to_tree (sizetype
, pad
->src_bndrng
[0]);
1496 slen
= size_zero_node
;
1501 const opt_code opt
= OPT_Wstringop_overread
;
1502 if (warning_suppressed_p (exp
, opt
)
1503 || (srcstr
&& warning_suppressed_p (srcstr
, opt
))
1504 || (pad
&& pad
->src
.ref
1505 && warning_suppressed_p (pad
->src
.ref
, opt
)))
1508 location_t loc
= get_location (exp
);
1510 = mode
== access_read_only
|| mode
== access_read_write
;
1511 const bool maybe
= pad
&& pad
->dst
.parmarray
;
1512 auto_diagnostic_group d
;
1513 if (warn_for_access (loc
, func
, exp
, opt
, range
, slen
, false, read
,
1516 suppress_warning (exp
, opt
);
1518 pad
->src
.inform_access (access_read_only
);
1527 check_access (gimple
*stmt
, tree dstwrite
,
1528 tree maxread
, tree srcstr
, tree dstsize
,
1529 access_mode mode
, const access_data
*pad
,
1532 return check_access
<gimple
*> (stmt
, dstwrite
, maxread
, srcstr
, dstsize
,
1537 check_access (tree expr
, tree dstwrite
,
1538 tree maxread
, tree srcstr
, tree dstsize
,
1539 access_mode mode
, const access_data
*pad
/* = NULL */)
1541 return check_access
<tree
> (expr
, dstwrite
, maxread
, srcstr
, dstsize
,
1542 mode
, pad
, nullptr);
1545 /* Return true if STMT is a call to an allocation function. Unless
1546 ALL_ALLOC is set, consider only functions that return dynamically
1547 allocated objects. Otherwise return true even for all forms of
1548 alloca (including VLA). */
1551 fndecl_alloc_p (tree fndecl
, bool all_alloc
)
1556 /* A call to operator new isn't recognized as one to a built-in. */
1557 if (DECL_IS_OPERATOR_NEW_P (fndecl
))
1560 if (fndecl_built_in_p (fndecl
, BUILT_IN_NORMAL
))
1562 switch (DECL_FUNCTION_CODE (fndecl
))
1564 case BUILT_IN_ALLOCA
:
1565 case BUILT_IN_ALLOCA_WITH_ALIGN
:
1567 case BUILT_IN_ALIGNED_ALLOC
:
1568 case BUILT_IN_CALLOC
:
1569 case BUILT_IN_GOMP_ALLOC
:
1570 case BUILT_IN_MALLOC
:
1571 case BUILT_IN_REALLOC
:
1572 case BUILT_IN_STRDUP
:
1573 case BUILT_IN_STRNDUP
:
1580 /* A function is considered an allocation function if it's declared
1581 with attribute malloc with an argument naming its associated
1582 deallocation function. */
1583 tree attrs
= DECL_ATTRIBUTES (fndecl
);
1587 for (tree allocs
= attrs
;
1588 (allocs
= lookup_attribute ("malloc", allocs
));
1589 allocs
= TREE_CHAIN (allocs
))
1591 tree args
= TREE_VALUE (allocs
);
1595 if (TREE_VALUE (args
))
1602 /* Return true if STMT is a call to an allocation function. A wrapper
1603 around fndecl_alloc_p. */
1606 gimple_call_alloc_p (gimple
*stmt
, bool all_alloc
= false)
1608 return fndecl_alloc_p (gimple_call_fndecl (stmt
), all_alloc
);
1611 /* Return true if DELC doesn't refer to an operator delete that's
1612 suitable to call with a pointer returned from the operator new
1613 described by NEWC. */
1616 new_delete_mismatch_p (const demangle_component
&newc
,
1617 const demangle_component
&delc
)
1619 if (newc
.type
!= delc
.type
)
1624 case DEMANGLE_COMPONENT_NAME
:
1626 int len
= newc
.u
.s_name
.len
;
1627 const char *news
= newc
.u
.s_name
.s
;
1628 const char *dels
= delc
.u
.s_name
.s
;
1629 if (len
!= delc
.u
.s_name
.len
|| memcmp (news
, dels
, len
))
1632 if (news
[len
] == 'n')
1634 if (news
[len
+ 1] == 'a')
1635 return dels
[len
] != 'd' || dels
[len
+ 1] != 'a';
1636 if (news
[len
+ 1] == 'w')
1637 return dels
[len
] != 'd' || dels
[len
+ 1] != 'l';
1642 case DEMANGLE_COMPONENT_OPERATOR
:
1643 /* Operator mismatches are handled above. */
1646 case DEMANGLE_COMPONENT_EXTENDED_OPERATOR
:
1647 if (newc
.u
.s_extended_operator
.args
!= delc
.u
.s_extended_operator
.args
)
1649 return new_delete_mismatch_p (*newc
.u
.s_extended_operator
.name
,
1650 *delc
.u
.s_extended_operator
.name
);
1652 case DEMANGLE_COMPONENT_FIXED_TYPE
:
1653 if (newc
.u
.s_fixed
.accum
!= delc
.u
.s_fixed
.accum
1654 || newc
.u
.s_fixed
.sat
!= delc
.u
.s_fixed
.sat
)
1656 return new_delete_mismatch_p (*newc
.u
.s_fixed
.length
,
1657 *delc
.u
.s_fixed
.length
);
1659 case DEMANGLE_COMPONENT_CTOR
:
1660 if (newc
.u
.s_ctor
.kind
!= delc
.u
.s_ctor
.kind
)
1662 return new_delete_mismatch_p (*newc
.u
.s_ctor
.name
,
1663 *delc
.u
.s_ctor
.name
);
1665 case DEMANGLE_COMPONENT_DTOR
:
1666 if (newc
.u
.s_dtor
.kind
!= delc
.u
.s_dtor
.kind
)
1668 return new_delete_mismatch_p (*newc
.u
.s_dtor
.name
,
1669 *delc
.u
.s_dtor
.name
);
1671 case DEMANGLE_COMPONENT_BUILTIN_TYPE
:
1673 /* The demangler API provides no better way to compare built-in
1674 types except to by comparing their demangled names. */
1676 demangle_component
*pnc
= const_cast<demangle_component
*>(&newc
);
1677 demangle_component
*pdc
= const_cast<demangle_component
*>(&delc
);
1678 char *nts
= cplus_demangle_print (0, pnc
, 16, &nsz
);
1679 char *dts
= cplus_demangle_print (0, pdc
, 16, &dsz
);
1682 bool mismatch
= strcmp (nts
, dts
);
1688 case DEMANGLE_COMPONENT_SUB_STD
:
1689 if (newc
.u
.s_string
.len
!= delc
.u
.s_string
.len
)
1691 return memcmp (newc
.u
.s_string
.string
, delc
.u
.s_string
.string
,
1692 newc
.u
.s_string
.len
);
1694 case DEMANGLE_COMPONENT_FUNCTION_PARAM
:
1695 case DEMANGLE_COMPONENT_TEMPLATE_PARAM
:
1696 return newc
.u
.s_number
.number
!= delc
.u
.s_number
.number
;
1698 case DEMANGLE_COMPONENT_CHARACTER
:
1699 return newc
.u
.s_character
.character
!= delc
.u
.s_character
.character
;
1701 case DEMANGLE_COMPONENT_DEFAULT_ARG
:
1702 case DEMANGLE_COMPONENT_LAMBDA
:
1703 if (newc
.u
.s_unary_num
.num
!= delc
.u
.s_unary_num
.num
)
1705 return new_delete_mismatch_p (*newc
.u
.s_unary_num
.sub
,
1706 *delc
.u
.s_unary_num
.sub
);
1711 if (!newc
.u
.s_binary
.left
!= !delc
.u
.s_binary
.left
)
1714 if (!newc
.u
.s_binary
.left
)
1717 if (new_delete_mismatch_p (*newc
.u
.s_binary
.left
, *delc
.u
.s_binary
.left
)
1718 || !newc
.u
.s_binary
.right
!= !delc
.u
.s_binary
.right
)
1721 if (newc
.u
.s_binary
.right
)
1722 return new_delete_mismatch_p (*newc
.u
.s_binary
.right
,
1723 *delc
.u
.s_binary
.right
);
1727 /* Return true if DELETE_DECL is an operator delete that's not suitable
1728 to call with a pointer returned from NEW_DECL. */
1731 new_delete_mismatch_p (tree new_decl
, tree delete_decl
)
1733 tree new_name
= DECL_ASSEMBLER_NAME (new_decl
);
1734 tree delete_name
= DECL_ASSEMBLER_NAME (delete_decl
);
1736 /* valid_new_delete_pair_p() returns a conservative result (currently
1737 it only handles global operators). A true result is reliable but
1738 a false result doesn't necessarily mean the operators don't match
1739 unless CERTAIN is set. */
1741 if (valid_new_delete_pair_p (new_name
, delete_name
, &certain
))
1743 /* CERTAIN is set when the negative result is certain. */
1747 /* For anything not handled by valid_new_delete_pair_p() such as member
1748 operators compare the individual demangled components of the mangled
1750 const char *new_str
= IDENTIFIER_POINTER (new_name
);
1751 const char *del_str
= IDENTIFIER_POINTER (delete_name
);
1753 void *np
= NULL
, *dp
= NULL
;
1754 demangle_component
*ndc
= cplus_demangle_v3_components (new_str
, 0, &np
);
1755 demangle_component
*ddc
= cplus_demangle_v3_components (del_str
, 0, &dp
);
1756 bool mismatch
= new_delete_mismatch_p (*ndc
, *ddc
);
1762 /* ALLOC_DECL and DEALLOC_DECL are pair of allocation and deallocation
1763 functions. Return true if the latter is suitable to deallocate objects
1764 allocated by calls to the former. */
1767 matching_alloc_calls_p (tree alloc_decl
, tree dealloc_decl
)
1769 /* Set to alloc_kind_t::builtin if ALLOC_DECL is associated with
1770 a built-in deallocator. */
1771 enum class alloc_kind_t
{ none
, builtin
, user
}
1772 alloc_dealloc_kind
= alloc_kind_t::none
;
1774 if (DECL_IS_OPERATOR_NEW_P (alloc_decl
))
1776 if (DECL_IS_OPERATOR_DELETE_P (dealloc_decl
))
1777 /* Return true iff both functions are of the same array or
1778 singleton form and false otherwise. */
1779 return !new_delete_mismatch_p (alloc_decl
, dealloc_decl
);
1781 /* Return false for deallocation functions that are known not
1783 if (fndecl_built_in_p (dealloc_decl
, BUILT_IN_FREE
)
1784 || fndecl_built_in_p (dealloc_decl
, BUILT_IN_REALLOC
))
1786 /* Otherwise proceed below to check the deallocation function's
1787 "*dealloc" attributes to look for one that mentions this operator
1790 else if (fndecl_built_in_p (alloc_decl
, BUILT_IN_NORMAL
))
1792 switch (DECL_FUNCTION_CODE (alloc_decl
))
1794 case BUILT_IN_ALLOCA
:
1795 case BUILT_IN_ALLOCA_WITH_ALIGN
:
1798 case BUILT_IN_ALIGNED_ALLOC
:
1799 case BUILT_IN_CALLOC
:
1800 case BUILT_IN_GOMP_ALLOC
:
1801 case BUILT_IN_MALLOC
:
1802 case BUILT_IN_REALLOC
:
1803 case BUILT_IN_STRDUP
:
1804 case BUILT_IN_STRNDUP
:
1805 if (DECL_IS_OPERATOR_DELETE_P (dealloc_decl
))
1808 if (fndecl_built_in_p (dealloc_decl
, BUILT_IN_FREE
)
1809 || fndecl_built_in_p (dealloc_decl
, BUILT_IN_REALLOC
))
1812 alloc_dealloc_kind
= alloc_kind_t::builtin
;
1820 /* Set if DEALLOC_DECL both allocates and deallocates. */
1821 alloc_kind_t realloc_kind
= alloc_kind_t::none
;
1823 if (fndecl_built_in_p (dealloc_decl
, BUILT_IN_NORMAL
))
1825 built_in_function dealloc_code
= DECL_FUNCTION_CODE (dealloc_decl
);
1826 if (dealloc_code
== BUILT_IN_REALLOC
)
1827 realloc_kind
= alloc_kind_t::builtin
;
1829 for (tree amats
= DECL_ATTRIBUTES (alloc_decl
);
1830 (amats
= lookup_attribute ("malloc", amats
));
1831 amats
= TREE_CHAIN (amats
))
1833 tree args
= TREE_VALUE (amats
);
1837 tree fndecl
= TREE_VALUE (args
);
1838 if (!fndecl
|| !DECL_P (fndecl
))
1841 if (fndecl_built_in_p (fndecl
, BUILT_IN_NORMAL
)
1842 && dealloc_code
== DECL_FUNCTION_CODE (fndecl
))
1847 const bool alloc_builtin
= fndecl_built_in_p (alloc_decl
, BUILT_IN_NORMAL
);
1848 alloc_kind_t realloc_dealloc_kind
= alloc_kind_t::none
;
1850 /* If DEALLOC_DECL has an internal "*dealloc" attribute scan the list
1851 of its associated allocation functions for ALLOC_DECL.
1852 If the corresponding ALLOC_DECL is found they're a matching pair,
1853 otherwise they're not.
1854 With DDATS set to the Deallocator's *Dealloc ATtributes... */
1855 for (tree ddats
= DECL_ATTRIBUTES (dealloc_decl
);
1856 (ddats
= lookup_attribute ("*dealloc", ddats
));
1857 ddats
= TREE_CHAIN (ddats
))
1859 tree args
= TREE_VALUE (ddats
);
1863 tree alloc
= TREE_VALUE (args
);
1867 if (alloc
== DECL_NAME (dealloc_decl
))
1868 realloc_kind
= alloc_kind_t::user
;
1872 gcc_checking_assert (fndecl_built_in_p (alloc
, BUILT_IN_NORMAL
));
1874 switch (DECL_FUNCTION_CODE (alloc
))
1876 case BUILT_IN_ALIGNED_ALLOC
:
1877 case BUILT_IN_CALLOC
:
1878 case BUILT_IN_GOMP_ALLOC
:
1879 case BUILT_IN_MALLOC
:
1880 case BUILT_IN_REALLOC
:
1881 case BUILT_IN_STRDUP
:
1882 case BUILT_IN_STRNDUP
:
1883 realloc_dealloc_kind
= alloc_kind_t::builtin
;
1892 if (DECL_FUNCTION_CODE (alloc
) != DECL_FUNCTION_CODE (alloc_decl
))
1898 if (alloc
== DECL_NAME (alloc_decl
))
1902 if (realloc_kind
== alloc_kind_t::none
)
1905 hash_set
<tree
> common_deallocs
;
1906 /* Special handling for deallocators. Iterate over both the allocator's
1907 and the reallocator's associated deallocator functions looking for
1908 the first one in common. If one is found, the de/reallocator is
1909 a match for the allocator even though the latter isn't directly
1910 associated with the former. This simplifies declarations in system
1912 With AMATS set to the Allocator's Malloc ATtributes,
1913 and RMATS set to Reallocator's Malloc ATtributes... */
1914 for (tree amats
= DECL_ATTRIBUTES (alloc_decl
),
1915 rmats
= DECL_ATTRIBUTES (dealloc_decl
);
1916 (amats
= lookup_attribute ("malloc", amats
))
1917 || (rmats
= lookup_attribute ("malloc", rmats
));
1918 amats
= amats
? TREE_CHAIN (amats
) : NULL_TREE
,
1919 rmats
= rmats
? TREE_CHAIN (rmats
) : NULL_TREE
)
1921 if (tree args
= amats
? TREE_VALUE (amats
) : NULL_TREE
)
1922 if (tree adealloc
= TREE_VALUE (args
))
1924 if (DECL_P (adealloc
)
1925 && fndecl_built_in_p (adealloc
, BUILT_IN_NORMAL
))
1927 built_in_function fncode
= DECL_FUNCTION_CODE (adealloc
);
1928 if (fncode
== BUILT_IN_FREE
|| fncode
== BUILT_IN_REALLOC
)
1930 if (realloc_kind
== alloc_kind_t::builtin
)
1932 alloc_dealloc_kind
= alloc_kind_t::builtin
;
1937 common_deallocs
.add (adealloc
);
1940 if (tree args
= rmats
? TREE_VALUE (rmats
) : NULL_TREE
)
1941 if (tree ddealloc
= TREE_VALUE (args
))
1943 if (DECL_P (ddealloc
)
1944 && fndecl_built_in_p (ddealloc
, BUILT_IN_NORMAL
))
1946 built_in_function fncode
= DECL_FUNCTION_CODE (ddealloc
);
1947 if (fncode
== BUILT_IN_FREE
|| fncode
== BUILT_IN_REALLOC
)
1949 if (alloc_dealloc_kind
== alloc_kind_t::builtin
)
1951 realloc_dealloc_kind
= alloc_kind_t::builtin
;
1956 if (common_deallocs
.add (ddealloc
))
1961 /* Succeed only if ALLOC_DECL and the reallocator DEALLOC_DECL share
1962 a built-in deallocator. */
1963 return (alloc_dealloc_kind
== alloc_kind_t::builtin
1964 && realloc_dealloc_kind
== alloc_kind_t::builtin
);
1967 /* Return true if DEALLOC_DECL is a function suitable to deallocate
1968 objects allocated by the ALLOC call. */
1971 matching_alloc_calls_p (gimple
*alloc
, tree dealloc_decl
)
1973 tree alloc_decl
= gimple_call_fndecl (alloc
);
1977 return matching_alloc_calls_p (alloc_decl
, dealloc_decl
);
1980 /* Diagnose a call EXP to deallocate a pointer referenced by AREF if it
1981 includes a nonzero offset. Such a pointer cannot refer to the beginning
1982 of an allocated object. A negative offset may refer to it only if
1983 the target pointer is unknown. */
1986 warn_dealloc_offset (location_t loc
, gimple
*call
, const access_ref
&aref
)
1988 if (aref
.deref
|| aref
.offrng
[0] <= 0 || aref
.offrng
[1] <= 0)
1991 tree dealloc_decl
= gimple_call_fndecl (call
);
1995 if (DECL_IS_OPERATOR_DELETE_P (dealloc_decl
)
1996 && !DECL_IS_REPLACEABLE_OPERATOR (dealloc_decl
))
1998 /* A call to a user-defined operator delete with a pointer plus offset
1999 may be valid if it's returned from an unknown function (i.e., one
2000 that's not operator new). */
2001 if (TREE_CODE (aref
.ref
) == SSA_NAME
)
2003 gimple
*def_stmt
= SSA_NAME_DEF_STMT (aref
.ref
);
2004 if (is_gimple_call (def_stmt
))
2006 tree alloc_decl
= gimple_call_fndecl (def_stmt
);
2007 if (!alloc_decl
|| !DECL_IS_OPERATOR_NEW_P (alloc_decl
))
2015 if (wi::fits_shwi_p (aref
.offrng
[0]))
2017 if (aref
.offrng
[0] == aref
.offrng
[1]
2018 || !wi::fits_shwi_p (aref
.offrng
[1]))
2019 sprintf (offstr
, " %lli",
2020 (long long)aref
.offrng
[0].to_shwi ());
2022 sprintf (offstr
, " [%lli, %lli]",
2023 (long long)aref
.offrng
[0].to_shwi (),
2024 (long long)aref
.offrng
[1].to_shwi ());
2027 auto_diagnostic_group d
;
2028 if (!warning_at (loc
, OPT_Wfree_nonheap_object
,
2029 "%qD called on pointer %qE with nonzero offset%s",
2030 dealloc_decl
, aref
.ref
, offstr
))
2033 if (DECL_P (aref
.ref
))
2034 inform (get_location (aref
.ref
), "declared here");
2035 else if (TREE_CODE (aref
.ref
) == SSA_NAME
)
2037 gimple
*def_stmt
= SSA_NAME_DEF_STMT (aref
.ref
);
2038 if (is_gimple_call (def_stmt
))
2040 location_t def_loc
= get_location (def_stmt
);
2041 tree alloc_decl
= gimple_call_fndecl (def_stmt
);
2044 "returned from %qD", alloc_decl
);
2045 else if (tree alloc_fntype
= gimple_call_fntype (def_stmt
))
2047 "returned from %qT", alloc_fntype
);
2049 inform (def_loc
, "obtained here");
2058 const pass_data pass_data_waccess
= {
2062 TV_WARN_ACCESS
, /* timer variable */
2063 PROP_cfg
, /* properties_required */
2064 0, /* properties_provided */
2065 0, /* properties_destroyed */
2066 0, /* properties_start */
2067 0, /* properties_finish */
2070 /* Pass to detect invalid accesses. */
2071 class pass_waccess
: public gimple_opt_pass
2074 pass_waccess (gcc::context
*);
2078 opt_pass
*clone () final override
;
2080 bool gate (function
*) final override
;
2082 void set_pass_param (unsigned, bool) final override
;
2084 unsigned int execute (function
*) final override
;
2087 /* Not copyable or assignable. */
2088 pass_waccess (pass_waccess
&) = delete;
2089 void operator= (pass_waccess
&) = delete;
2091 /* Check a call to an atomic built-in function. */
2092 bool check_atomic_builtin (gcall
*);
2094 /* Check a call to a built-in function. */
2095 bool check_builtin (gcall
*);
2097 /* Check a call to an ordinary function for invalid accesses. */
2098 bool check_call_access (gcall
*);
2100 /* Check a non-call statement. */
2101 void check_stmt (gimple
*);
2103 /* Check statements in a basic block. */
2104 void check_block (basic_block
);
2106 /* Check a call to a function. */
2107 void check_call (gcall
*);
2109 /* Check a call to the named built-in function. */
2110 void check_alloca (gcall
*);
2111 void check_alloc_size_call (gcall
*);
2112 void check_strcat (gcall
*);
2113 void check_strncat (gcall
*);
2114 void check_stxcpy (gcall
*);
2115 void check_stxncpy (gcall
*);
2116 void check_strncmp (gcall
*);
2117 void check_memop_access (gimple
*, tree
, tree
, tree
);
2118 void check_read_access (gimple
*, tree
, tree
= NULL_TREE
, int = 1);
2120 void maybe_check_dealloc_call (gcall
*);
2121 void maybe_check_access_sizes (rdwr_map
*, tree
, tree
, gimple
*);
2122 bool maybe_warn_memmodel (gimple
*, tree
, tree
, const unsigned char *);
2123 void check_atomic_memmodel (gimple
*, tree
, tree
, const unsigned char *);
2125 /* Check for uses of indeterminate pointers. */
2126 void check_pointer_uses (gimple
*, tree
, tree
= NULL_TREE
, bool = false);
2128 /* Return the argument that a call returns. */
2129 tree
gimple_call_return_arg (gcall
*);
2131 /* Check a call for uses of a dangling pointer arguments. */
2132 void check_call_dangling (gcall
*);
2134 /* Check uses of a dangling pointer or those derived from it. */
2135 void check_dangling_uses (tree
, tree
, bool = false, bool = false);
2136 void check_dangling_uses ();
2137 void check_dangling_stores ();
2138 void check_dangling_stores (basic_block
, hash_set
<tree
> &, auto_bitmap
&);
2140 void warn_invalid_pointer (tree
, gimple
*, gimple
*, tree
, bool, bool = false);
2142 /* Return true if use follows an invalidating statement. */
2143 bool use_after_inval_p (gimple
*, gimple
*, bool = false);
2145 /* A pointer_query object to store information about pointers and
2146 their targets in. */
2147 pointer_query m_ptr_qry
;
2148 /* Mapping from DECLs and their clobber statements in the function. */
2149 hash_map
<tree
, gimple
*> m_clobbers
;
2150 /* A bit is set for each basic block whose statements have been assigned
2152 bitmap m_bb_uids_set
;
2153 /* The current function. */
2155 /* True to run checks for uses of dangling pointers. */
2156 bool m_check_dangling_p
;
2157 /* True to run checks early on in the optimization pipeline. */
2158 bool m_early_checks_p
;
2161 /* Construct the pass. */
2163 pass_waccess::pass_waccess (gcc::context
*ctxt
)
2164 : gimple_opt_pass (pass_data_waccess
, ctxt
),
2169 m_check_dangling_p (),
2174 /* Return a copy of the pass with RUN_NUMBER one greater than THIS. */
2177 pass_waccess::clone ()
2179 return new pass_waccess (m_ctxt
);
2182 /* Release pointer_query cache. */
2184 pass_waccess::~pass_waccess ()
2186 m_ptr_qry
.flush_cache ();
2190 pass_waccess::set_pass_param (unsigned int n
, bool early
)
2192 gcc_assert (n
== 0);
2194 m_early_checks_p
= early
;
2197 /* Return true when any checks performed by the pass are enabled. */
2200 pass_waccess::gate (function
*)
2202 return (warn_free_nonheap_object
2203 || warn_mismatched_alloc
2204 || warn_mismatched_new_delete
);
2207 /* Initialize ALLOC_OBJECT_SIZE_LIMIT based on the -Walloc-size-larger-than=
2208 setting if the option is specified, or to the maximum object size if it
2209 is not. Return the initialized value. */
2212 alloc_max_size (void)
2214 HOST_WIDE_INT limit
= warn_alloc_size_limit
;
2215 if (limit
== HOST_WIDE_INT_MAX
)
2216 limit
= tree_to_shwi (TYPE_MAX_VALUE (ptrdiff_type_node
));
2218 return build_int_cst (size_type_node
, limit
);
2221 /* Diagnose a call EXP to function FN decorated with attribute alloc_size
2222 whose argument numbers given by IDX with values given by ARGS exceed
2223 the maximum object size or cause an unsigned overflow (wrapping) when
2224 multiplied. FN is null when EXP is a call via a function pointer.
2225 When ARGS[0] is null the function does nothing. ARGS[1] may be null
2226 for functions like malloc, and non-null for those like calloc that
2227 are decorated with a two-argument attribute alloc_size. */
2230 maybe_warn_alloc_args_overflow (gimple
*stmt
, const tree args
[2],
2233 /* The range each of the (up to) two arguments is known to be in. */
2234 tree argrange
[2][2] = { { NULL_TREE
, NULL_TREE
}, { NULL_TREE
, NULL_TREE
} };
2236 /* Maximum object size set by -Walloc-size-larger-than= or SIZE_MAX / 2. */
2237 tree maxobjsize
= alloc_max_size ();
2239 location_t loc
= get_location (stmt
);
2241 tree fn
= gimple_call_fndecl (stmt
);
2242 tree fntype
= fn
? TREE_TYPE (fn
) : gimple_call_fntype (stmt
);
2243 bool warned
= false;
2245 /* Validate each argument individually. */
2246 for (unsigned i
= 0; i
!= 2 && args
[i
]; ++i
)
2248 if (TREE_CODE (args
[i
]) == INTEGER_CST
)
2250 argrange
[i
][0] = args
[i
];
2251 argrange
[i
][1] = args
[i
];
2253 if (tree_int_cst_lt (args
[i
], integer_zero_node
))
2255 warned
= warning_at (loc
, OPT_Walloc_size_larger_than_
,
2256 "argument %i value %qE is negative",
2257 idx
[i
] + 1, args
[i
]);
2259 else if (integer_zerop (args
[i
]))
2261 /* Avoid issuing -Walloc-zero for allocation functions other
2262 than __builtin_alloca that are declared with attribute
2263 returns_nonnull because there's no portability risk. This
2264 avoids warning for such calls to libiberty's xmalloc and
2266 Also avoid issuing the warning for calls to function named
2268 if (fn
&& fndecl_built_in_p (fn
, BUILT_IN_ALLOCA
)
2269 ? IDENTIFIER_LENGTH (DECL_NAME (fn
)) != 6
2270 : !lookup_attribute ("returns_nonnull",
2271 TYPE_ATTRIBUTES (fntype
)))
2272 warned
= warning_at (loc
, OPT_Walloc_zero
,
2273 "argument %i value is zero",
2276 else if (tree_int_cst_lt (maxobjsize
, args
[i
]))
2278 /* G++ emits calls to ::operator new[](SIZE_MAX) in C++98
2279 mode and with -fno-exceptions as a way to indicate array
2280 size overflow. There's no good way to detect C++98 here
2281 so avoid diagnosing these calls for all C++ modes. */
2286 && DECL_IS_OPERATOR_NEW_P (fn
)
2287 && integer_all_onesp (args
[i
]))
2290 warned
= warning_at (loc
, OPT_Walloc_size_larger_than_
,
2291 "argument %i value %qE exceeds "
2292 "maximum object size %E",
2293 idx
[i
] + 1, args
[i
], maxobjsize
);
2296 else if (TREE_CODE (args
[i
]) == SSA_NAME
2297 && get_size_range (args
[i
], argrange
[i
]))
2299 /* Verify that the argument's range is not negative (including
2300 upper bound of zero). */
2301 if (tree_int_cst_lt (argrange
[i
][0], integer_zero_node
)
2302 && tree_int_cst_le (argrange
[i
][1], integer_zero_node
))
2304 warned
= warning_at (loc
, OPT_Walloc_size_larger_than_
,
2305 "argument %i range [%E, %E] is negative",
2307 argrange
[i
][0], argrange
[i
][1]);
2309 else if (tree_int_cst_lt (maxobjsize
, argrange
[i
][0]))
2311 warned
= warning_at (loc
, OPT_Walloc_size_larger_than_
,
2312 "argument %i range [%E, %E] exceeds "
2313 "maximum object size %E",
2315 argrange
[i
][0], argrange
[i
][1],
2321 if (!argrange
[0][0])
2324 /* For a two-argument alloc_size, validate the product of the two
2325 arguments if both of their values or ranges are known. */
2326 if (!warned
&& tree_fits_uhwi_p (argrange
[0][0])
2327 && argrange
[1][0] && tree_fits_uhwi_p (argrange
[1][0])
2328 && !integer_onep (argrange
[0][0])
2329 && !integer_onep (argrange
[1][0]))
2331 /* Check for overflow in the product of a function decorated with
2332 attribute alloc_size (X, Y). */
2333 unsigned szprec
= TYPE_PRECISION (size_type_node
);
2334 wide_int x
= wi::to_wide (argrange
[0][0], szprec
);
2335 wide_int y
= wi::to_wide (argrange
[1][0], szprec
);
2337 wi::overflow_type vflow
;
2338 wide_int prod
= wi::umul (x
, y
, &vflow
);
2341 warned
= warning_at (loc
, OPT_Walloc_size_larger_than_
,
2342 "product %<%E * %E%> of arguments %i and %i "
2343 "exceeds %<SIZE_MAX%>",
2344 argrange
[0][0], argrange
[1][0],
2345 idx
[0] + 1, idx
[1] + 1);
2346 else if (wi::ltu_p (wi::to_wide (maxobjsize
, szprec
), prod
))
2347 warned
= warning_at (loc
, OPT_Walloc_size_larger_than_
,
2348 "product %<%E * %E%> of arguments %i and %i "
2349 "exceeds maximum object size %E",
2350 argrange
[0][0], argrange
[1][0],
2351 idx
[0] + 1, idx
[1] + 1,
2356 /* Print the full range of each of the two arguments to make
2357 it clear when it is, in fact, in a range and not constant. */
2358 if (argrange
[0][0] != argrange
[0][1])
2359 inform (loc
, "argument %i in the range [%E, %E]",
2360 idx
[0] + 1, argrange
[0][0], argrange
[0][1]);
2361 if (argrange
[1][0] != argrange
[1][1])
2362 inform (loc
, "argument %i in the range [%E, %E]",
2363 idx
[1] + 1, argrange
[1][0], argrange
[1][1]);
2369 location_t fnloc
= DECL_SOURCE_LOCATION (fn
);
2371 if (DECL_IS_UNDECLARED_BUILTIN (fn
))
2373 "in a call to built-in allocation function %qD", fn
);
2376 "in a call to allocation function %qD declared here", fn
);
2380 /* Check a call to an alloca function for an excessive size. */
2383 pass_waccess::check_alloca (gcall
*stmt
)
2385 if (m_early_checks_p
)
2388 if ((warn_vla_limit
>= HOST_WIDE_INT_MAX
2389 && warn_alloc_size_limit
< warn_vla_limit
)
2390 || (warn_alloca_limit
>= HOST_WIDE_INT_MAX
2391 && warn_alloc_size_limit
< warn_alloca_limit
))
2393 /* -Walloca-larger-than and -Wvla-larger-than settings of less
2394 than HWI_MAX override the more general -Walloc-size-larger-than
2395 so unless either of the former options is smaller than the last
2396 one (which would imply that the call was already checked), check
2397 the alloca arguments for overflow. */
2398 const tree alloc_args
[] = { call_arg (stmt
, 0), NULL_TREE
};
2399 const int idx
[] = { 0, -1 };
2400 maybe_warn_alloc_args_overflow (stmt
, alloc_args
, idx
);
2404 /* Check a call to an allocation function for an excessive size. */
2407 pass_waccess::check_alloc_size_call (gcall
*stmt
)
2409 if (m_early_checks_p
)
2412 if (gimple_call_num_args (stmt
) < 1)
2413 /* Avoid invalid calls to functions without a prototype. */
2416 tree fndecl
= gimple_call_fndecl (stmt
);
2417 if (fndecl
&& gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
))
2419 /* Alloca is handled separately. */
2420 switch (DECL_FUNCTION_CODE (fndecl
))
2422 case BUILT_IN_ALLOCA
:
2423 case BUILT_IN_ALLOCA_WITH_ALIGN
:
2424 case BUILT_IN_ALLOCA_WITH_ALIGN_AND_MAX
:
2431 tree fntype
= gimple_call_fntype (stmt
);
2432 tree fntypeattrs
= TYPE_ATTRIBUTES (fntype
);
2434 tree alloc_size
= lookup_attribute ("alloc_size", fntypeattrs
);
2438 /* Extract attribute alloc_size from the type of the called expression
2439 (which could be a function or a function pointer) and if set, store
2440 the indices of the corresponding arguments in ALLOC_IDX, and then
2441 the actual argument(s) at those indices in ALLOC_ARGS. */
2442 int idx
[2] = { -1, -1 };
2443 tree alloc_args
[] = { NULL_TREE
, NULL_TREE
};
2444 unsigned nargs
= gimple_call_num_args (stmt
);
2446 tree args
= TREE_VALUE (alloc_size
);
2447 idx
[0] = TREE_INT_CST_LOW (TREE_VALUE (args
)) - 1;
2448 /* Avoid invalid calls to functions without a prototype. */
2449 if ((unsigned) idx
[0] >= nargs
)
2451 alloc_args
[0] = call_arg (stmt
, idx
[0]);
2452 if (TREE_CHAIN (args
))
2454 idx
[1] = TREE_INT_CST_LOW (TREE_VALUE (TREE_CHAIN (args
))) - 1;
2455 if ((unsigned) idx
[1] >= nargs
)
2457 alloc_args
[1] = call_arg (stmt
, idx
[1]);
2460 maybe_warn_alloc_args_overflow (stmt
, alloc_args
, idx
);
2463 /* Check a call STMT to strcat() for overflow and warn if it does. */
2466 pass_waccess::check_strcat (gcall
*stmt
)
2468 if (m_early_checks_p
)
2471 if (!warn_stringop_overflow
&& !warn_stringop_overread
)
2474 tree dest
= call_arg (stmt
, 0);
2475 tree src
= call_arg (stmt
, 1);
2477 /* There is no way here to determine the length of the string in
2478 the destination to which the SRC string is being appended so
2479 just diagnose cases when the source string is longer than
2480 the destination object. */
2481 access_data
data (m_ptr_qry
.rvals
, stmt
, access_read_write
, NULL_TREE
,
2482 true, NULL_TREE
, true);
2483 const int ost
= warn_stringop_overflow
? warn_stringop_overflow
- 1 : 1;
2484 compute_objsize (src
, stmt
, ost
, &data
.src
, &m_ptr_qry
);
2485 tree destsize
= compute_objsize (dest
, stmt
, ost
, &data
.dst
, &m_ptr_qry
);
2487 check_access (stmt
, /*dstwrite=*/NULL_TREE
, /*maxread=*/NULL_TREE
,
2488 src
, destsize
, data
.mode
, &data
, m_ptr_qry
.rvals
);
2491 /* Check a call STMT to strcat() for overflow and warn if it does. */
2494 pass_waccess::check_strncat (gcall
*stmt
)
2496 if (m_early_checks_p
)
2499 if (!warn_stringop_overflow
&& !warn_stringop_overread
)
2502 tree dest
= call_arg (stmt
, 0);
2503 tree src
= call_arg (stmt
, 1);
2504 /* The upper bound on the number of bytes to write. */
2505 tree maxread
= call_arg (stmt
, 2);
2507 /* Detect unterminated source (only). */
2508 if (!check_nul_terminated_array (stmt
, src
, maxread
))
2511 /* The length of the source sequence. */
2512 tree slen
= c_strlen (src
, 1);
2514 /* Try to determine the range of lengths that the source expression
2515 refers to. Since the lengths are only used for warning and not
2516 for code generation disable strict mode below. */
2520 c_strlen_data lendata
= { };
2521 get_range_strlen (src
, &lendata
, /* eltsize = */ 1);
2522 maxlen
= lendata
.maxbound
;
2525 access_data
data (m_ptr_qry
.rvals
, stmt
, access_read_write
);
2526 /* Try to verify that the destination is big enough for the shortest
2527 string. First try to determine the size of the destination object
2528 into which the source is being copied. */
2529 const int ost
= warn_stringop_overflow
- 1;
2530 tree destsize
= compute_objsize (dest
, stmt
, ost
, &data
.dst
, &m_ptr_qry
);
2532 /* Add one for the terminating nul. */
2533 tree srclen
= (maxlen
2534 ? fold_build2 (PLUS_EXPR
, size_type_node
, maxlen
,
2538 /* The strncat function copies at most MAXREAD bytes and always appends
2539 the terminating nul so the specified upper bound should never be equal
2540 to (or greater than) the size of the destination. */
2541 if (tree_fits_uhwi_p (maxread
) && tree_fits_uhwi_p (destsize
)
2542 && tree_int_cst_equal (destsize
, maxread
))
2544 location_t loc
= get_location (stmt
);
2545 warning_at (loc
, OPT_Wstringop_overflow_
,
2546 "%qD specified bound %E equals destination size",
2547 get_callee_fndecl (stmt
), maxread
);
2553 || (maxread
&& tree_fits_uhwi_p (maxread
)
2554 && tree_fits_uhwi_p (srclen
)
2555 && tree_int_cst_lt (maxread
, srclen
)))
2558 check_access (stmt
, /*dstwrite=*/NULL_TREE
, maxread
, srclen
,
2559 destsize
, data
.mode
, &data
, m_ptr_qry
.rvals
);
2562 /* Check a call STMT to stpcpy() or strcpy() for overflow and warn
2566 pass_waccess::check_stxcpy (gcall
*stmt
)
2568 if (m_early_checks_p
)
2571 tree dst
= call_arg (stmt
, 0);
2572 tree src
= call_arg (stmt
, 1);
2576 if (tree nonstr
= unterminated_array (src
, &size
, &exact
))
2578 /* NONSTR refers to the non-nul terminated constant array. */
2579 warn_string_no_nul (get_location (stmt
), stmt
, NULL
, src
, nonstr
,
2584 if (warn_stringop_overflow
)
2586 access_data
data (m_ptr_qry
.rvals
, stmt
, access_read_write
, NULL_TREE
,
2587 true, NULL_TREE
, true);
2588 const int ost
= warn_stringop_overflow
? warn_stringop_overflow
- 1 : 1;
2589 compute_objsize (src
, stmt
, ost
, &data
.src
, &m_ptr_qry
);
2590 tree dstsize
= compute_objsize (dst
, stmt
, ost
, &data
.dst
, &m_ptr_qry
);
2591 check_access (stmt
, /*dstwrite=*/ NULL_TREE
,
2592 /*maxread=*/ NULL_TREE
, /*srcstr=*/ src
,
2593 dstsize
, data
.mode
, &data
, m_ptr_qry
.rvals
);
2596 /* Check to see if the argument was declared attribute nonstring
2597 and if so, issue a warning since at this point it's not known
2598 to be nul-terminated. */
2599 tree fndecl
= get_callee_fndecl (stmt
);
2600 maybe_warn_nonstring_arg (fndecl
, stmt
);
2603 /* Check a call STMT to stpncpy() or strncpy() for overflow and warn
2607 pass_waccess::check_stxncpy (gcall
*stmt
)
2609 if (m_early_checks_p
|| !warn_stringop_overflow
)
2612 tree dst
= call_arg (stmt
, 0);
2613 tree src
= call_arg (stmt
, 1);
2614 /* The number of bytes to write (not the maximum). */
2615 tree len
= call_arg (stmt
, 2);
2617 access_data
data (m_ptr_qry
.rvals
, stmt
, access_read_write
, len
, true, len
,
2619 const int ost
= warn_stringop_overflow
? warn_stringop_overflow
- 1 : 1;
2620 compute_objsize (src
, stmt
, ost
, &data
.src
, &m_ptr_qry
);
2621 tree dstsize
= compute_objsize (dst
, stmt
, ost
, &data
.dst
, &m_ptr_qry
);
2623 check_access (stmt
, /*dstwrite=*/len
, /*maxread=*/len
, src
, dstsize
,
2624 data
.mode
, &data
, m_ptr_qry
.rvals
);
2627 /* Check a call STMT to stpncpy() or strncpy() for overflow and warn
2631 pass_waccess::check_strncmp (gcall
*stmt
)
2633 if (m_early_checks_p
|| !warn_stringop_overread
)
2636 tree arg1
= call_arg (stmt
, 0);
2637 tree arg2
= call_arg (stmt
, 1);
2638 tree bound
= call_arg (stmt
, 2);
2640 /* First check each argument separately, considering the bound. */
2641 if (!check_nul_terminated_array (stmt
, arg1
, bound
)
2642 || !check_nul_terminated_array (stmt
, arg2
, bound
))
2645 /* A strncmp read from each argument is constrained not just by
2646 the bound but also by the length of the shorter string. Specifying
2647 a bound that's larger than the size of either array makes no sense
2648 and is likely a bug. When the length of neither of the two strings
2649 is known but the sizes of both of the arrays they are stored in is,
2650 issue a warning if the bound is larger than the size of
2651 the larger of the two arrays. */
2653 c_strlen_data lendata1
{ }, lendata2
{ };
2654 tree len1
= c_strlen (arg1
, 1, &lendata1
);
2655 tree len2
= c_strlen (arg2
, 1, &lendata2
);
2657 if (len1
&& TREE_CODE (len1
) != INTEGER_CST
)
2659 if (len2
&& TREE_CODE (len2
) != INTEGER_CST
)
2663 /* If the length of both arguments was computed they must both be
2664 nul-terminated and no further checking is necessary regardless
2668 /* Check to see if the argument was declared with attribute nonstring
2669 and if so, issue a warning since at this point it's not known to be
2671 if (maybe_warn_nonstring_arg (get_callee_fndecl (stmt
), stmt
))
2674 access_data
adata1 (m_ptr_qry
.rvals
, stmt
, access_read_only
, NULL_TREE
, false,
2676 access_data
adata2 (m_ptr_qry
.rvals
, stmt
, access_read_only
, NULL_TREE
, false,
2679 /* Determine the range of the bound first and bail if it fails; it's
2680 cheaper than computing the size of the objects. */
2681 tree bndrng
[2] = { NULL_TREE
, NULL_TREE
};
2682 get_size_range (m_ptr_qry
.rvals
, bound
, stmt
, bndrng
, adata1
.src_bndrng
);
2683 if (!bndrng
[0] || integer_zerop (bndrng
[0]))
2686 if (len1
&& tree_int_cst_lt (len1
, bndrng
[0]))
2688 if (len2
&& tree_int_cst_lt (len2
, bndrng
[0]))
2691 /* compute_objsize almost never fails (and ultimately should never
2692 fail). Don't bother to handle the rare case when it does. */
2693 if (!compute_objsize (arg1
, stmt
, 1, &adata1
.src
, &m_ptr_qry
)
2694 || !compute_objsize (arg2
, stmt
, 1, &adata2
.src
, &m_ptr_qry
))
2697 /* Compute the size of the remaining space in each array after
2698 subtracting any offset into it. */
2699 offset_int rem1
= adata1
.src
.size_remaining ();
2700 offset_int rem2
= adata2
.src
.size_remaining ();
2702 /* Cap REM1 and REM2 at the other if the other's argument is known
2703 to be an unterminated array, either because there's no space
2704 left in it after adding its offset or because it's constant and
2706 if (rem1
== 0 || (rem1
< rem2
&& lendata1
.decl
))
2708 else if (rem2
== 0 || (rem2
< rem1
&& lendata2
.decl
))
2711 /* Point PAD at the array to reference in the note if a warning
2713 access_data
*pad
= len1
? &adata2
: &adata1
;
2714 offset_int maxrem
= wi::max (rem1
, rem2
, UNSIGNED
);
2715 if (lendata1
.decl
|| lendata2
.decl
2716 || maxrem
< wi::to_offset (bndrng
[0]))
2718 /* Warn when either argument isn't nul-terminated or the maximum
2719 remaining space in the two arrays is less than the bound. */
2720 tree func
= get_callee_fndecl (stmt
);
2721 location_t loc
= gimple_location (stmt
);
2722 maybe_warn_for_bound (OPT_Wstringop_overread
, loc
, stmt
, func
,
2723 bndrng
, wide_int_to_tree (sizetype
, maxrem
),
2728 /* Determine and check the sizes of the source and the destination
2729 of calls to __builtin_{bzero,memcpy,mempcpy,memset} calls. STMT is
2730 the call statement, DEST is the destination argument, SRC is the source
2731 argument or null, and SIZE is the number of bytes being accessed. Use
2732 Object Size type-0 regardless of the OPT_Wstringop_overflow_ setting.
2733 Return true on success (no overflow or invalid sizes), false otherwise. */
2736 pass_waccess::check_memop_access (gimple
*stmt
, tree dest
, tree src
, tree size
)
2738 if (m_early_checks_p
)
2741 /* For functions like memset and memcpy that operate on raw memory
2742 try to determine the size of the largest source and destination
2743 object using type-0 Object Size regardless of the object size
2744 type specified by the option. */
2745 access_data
data (m_ptr_qry
.rvals
, stmt
, access_read_write
);
2747 = src
? compute_objsize (src
, stmt
, 0, &data
.src
, &m_ptr_qry
) : NULL_TREE
;
2748 tree dstsize
= compute_objsize (dest
, stmt
, 0, &data
.dst
, &m_ptr_qry
);
2750 check_access (stmt
, size
, /*maxread=*/NULL_TREE
, srcsize
, dstsize
,
2751 data
.mode
, &data
, m_ptr_qry
.rvals
);
2754 /* A convenience wrapper for check_access to check access by a read-only
2755 function like puts or strcmp. */
2758 pass_waccess::check_read_access (gimple
*stmt
, tree src
,
2759 tree bound
/* = NULL_TREE */,
2762 if (m_early_checks_p
|| !warn_stringop_overread
)
2765 if (bound
&& !useless_type_conversion_p (size_type_node
, TREE_TYPE (bound
)))
2766 bound
= fold_convert (size_type_node
, bound
);
2768 tree fndecl
= get_callee_fndecl (stmt
);
2769 maybe_warn_nonstring_arg (fndecl
, stmt
);
2771 access_data
data (m_ptr_qry
.rvals
, stmt
, access_read_only
, NULL_TREE
,
2772 false, bound
, true);
2773 compute_objsize (src
, stmt
, ost
, &data
.src
, &m_ptr_qry
);
2774 check_access (stmt
, /*dstwrite=*/ NULL_TREE
, /*maxread=*/ bound
,
2775 /*srcstr=*/ src
, /*dstsize=*/ NULL_TREE
, data
.mode
,
2776 &data
, m_ptr_qry
.rvals
);
2779 /* Return true if memory model ORD is constant in the context of STMT and
2780 set *CSTVAL to the constant value. Otherwise return false. Warn for
2784 memmodel_to_uhwi (tree ord
, gimple
*stmt
, unsigned HOST_WIDE_INT
*cstval
)
2786 unsigned HOST_WIDE_INT val
;
2788 if (TREE_CODE (ord
) == INTEGER_CST
)
2790 if (!tree_fits_uhwi_p (ord
))
2792 val
= tree_to_uhwi (ord
);
2796 /* Use the range query to determine constant values in the absence
2797 of constant propagation (such as at -O0). */
2798 Value_Range
rng (TREE_TYPE (ord
));
2799 if (!get_range_query (cfun
)->range_of_expr (rng
, ord
, stmt
)
2800 || !rng
.singleton_p (&ord
))
2803 wide_int lob
= rng
.lower_bound ();
2804 if (!wi::fits_uhwi_p (lob
))
2807 val
= lob
.to_shwi ();
2810 if (targetm
.memmodel_check
)
2811 /* This might warn for an invalid VAL but return a conservatively
2813 val
= targetm
.memmodel_check (val
);
2814 else if (val
& ~MEMMODEL_MASK
)
2816 tree fndecl
= gimple_call_fndecl (stmt
);
2817 location_t loc
= gimple_location (stmt
);
2818 loc
= expansion_point_location_if_in_system_header (loc
);
2820 warning_at (loc
, OPT_Winvalid_memory_model
,
2821 "unknown architecture specifier in memory model "
2822 "%wi for %qD", val
, fndecl
);
2831 /* Valid memory model for each set of atomic built-in functions. */
2833 struct memmodel_pair
2836 const char* modname
;
2838 #define MEMMODEL_PAIR(val, str) \
2839 { MEMMODEL_ ## val, "memory_order_" str }
2842 /* Valid memory models in the order of increasing strength. */
2844 static const memmodel_pair memory_models
[] =
2845 { MEMMODEL_PAIR (RELAXED
, "relaxed"),
2846 MEMMODEL_PAIR (SEQ_CST
, "seq_cst"),
2847 MEMMODEL_PAIR (ACQUIRE
, "acquire"),
2848 MEMMODEL_PAIR (CONSUME
, "consume"),
2849 MEMMODEL_PAIR (RELEASE
, "release"),
2850 MEMMODEL_PAIR (ACQ_REL
, "acq_rel")
2853 /* Return the name of the memory model VAL. */
2856 memmodel_name (unsigned HOST_WIDE_INT val
)
2858 val
= memmodel_base (val
);
2860 for (unsigned i
= 0; i
!= ARRAY_SIZE (memory_models
); ++i
)
2862 if (val
== memory_models
[i
].modval
)
2863 return memory_models
[i
].modname
;
2868 /* Indices of valid MEMORY_MODELS above for corresponding atomic operations. */
2869 static const unsigned char load_models
[] = { 0, 1, 2, 3, UCHAR_MAX
};
2870 static const unsigned char store_models
[] = { 0, 1, 4, UCHAR_MAX
};
2871 static const unsigned char xchg_models
[] = { 0, 1, 3, 4, 5, UCHAR_MAX
};
2872 static const unsigned char flag_clr_models
[] = { 0, 1, 4, UCHAR_MAX
};
2873 static const unsigned char all_models
[] = { 0, 1, 2, 3, 4, 5, UCHAR_MAX
};
2875 /* Check the success memory model argument ORD_SUCS to the call STMT to
2876 an atomic function and warn if it's invalid. If nonnull, also check
2877 the failure memory model ORD_FAIL and warn if it's invalid. Return
2878 true if a warning has been issued. */
2881 pass_waccess::maybe_warn_memmodel (gimple
*stmt
, tree ord_sucs
,
2882 tree ord_fail
, const unsigned char *valid
)
2884 unsigned HOST_WIDE_INT sucs
, fail
= 0;
2885 if (!memmodel_to_uhwi (ord_sucs
, stmt
, &sucs
)
2886 || (ord_fail
&& !memmodel_to_uhwi (ord_fail
, stmt
, &fail
)))
2889 bool is_valid
= false;
2891 for (unsigned i
= 0; valid
[i
] != UCHAR_MAX
; ++i
)
2893 memmodel model
= memory_models
[valid
[i
]].modval
;
2894 if (memmodel_base (sucs
) == model
)
2903 tree fndecl
= gimple_call_fndecl (stmt
);
2904 location_t loc
= gimple_location (stmt
);
2905 loc
= expansion_point_location_if_in_system_header (loc
);
2909 bool warned
= false;
2910 auto_diagnostic_group d
;
2911 if (const char *modname
= memmodel_name (sucs
))
2912 warned
= warning_at (loc
, OPT_Winvalid_memory_model
,
2913 "invalid memory model %qs for %qD",
2916 warned
= warning_at (loc
, OPT_Winvalid_memory_model
,
2917 "invalid memory model %wi for %qD",
2923 /* Print a note with the valid memory models. */
2925 pp_show_color (&pp
) = pp_show_color (global_dc
->printer
);
2926 for (unsigned i
= 0; valid
[i
] != UCHAR_MAX
; ++i
)
2928 const char *modname
= memory_models
[valid
[i
]].modname
;
2929 pp_printf (&pp
, "%s%qs", i
? ", " : "", modname
);
2932 inform (loc
, "valid models are %s", pp_formatted_text (&pp
));
2939 if (fail
== MEMMODEL_RELEASE
|| fail
== MEMMODEL_ACQ_REL
)
2940 if (const char *failname
= memmodel_name (fail
))
2942 /* If both memory model arguments are valid but their combination
2943 is not, use their names in the warning. */
2944 auto_diagnostic_group d
;
2945 if (!warning_at (loc
, OPT_Winvalid_memory_model
,
2946 "invalid failure memory model %qs for %qD",
2951 "valid failure models are %qs, %qs, %qs, %qs",
2952 "memory_order_relaxed", "memory_order_seq_cst",
2953 "memory_order_acquire", "memory_order_consume");
2957 if (memmodel_base (fail
) <= memmodel_base (sucs
))
2960 if (const char *sucsname
= memmodel_name (sucs
))
2961 if (const char *failname
= memmodel_name (fail
))
2963 /* If both memory model arguments are valid but their combination
2964 is not, use their names in the warning. */
2965 auto_diagnostic_group d
;
2966 if (!warning_at (loc
, OPT_Winvalid_memory_model
,
2967 "failure memory model %qs cannot be stronger "
2968 "than success memory model %qs for %qD",
2969 failname
, sucsname
, fndecl
))
2972 /* Print a note with the valid failure memory models which are
2973 those with a value less than or equal to the success mode. */
2976 for (unsigned i
= 0;
2977 memory_models
[i
].modval
<= memmodel_base (sucs
); ++i
)
2982 const char *modname
= memory_models
[valid
[i
]].modname
;
2983 sprintf (buf
+ strlen (buf
), "'%s'", modname
);
2986 inform (loc
, "valid models are %s", buf
);
2990 /* If either memory model argument value is invalid use the numerical
2991 value of both in the message. */
2992 return warning_at (loc
, OPT_Winvalid_memory_model
,
2993 "failure memory model %wi cannot be stronger "
2994 "than success memory model %wi for %qD",
2995 fail
, sucs
, fndecl
);
2998 /* Wrapper for the above. */
3001 pass_waccess::check_atomic_memmodel (gimple
*stmt
, tree ord_sucs
,
3002 tree ord_fail
, const unsigned char *valid
)
3004 if (warning_suppressed_p (stmt
, OPT_Winvalid_memory_model
))
3007 if (!maybe_warn_memmodel (stmt
, ord_sucs
, ord_fail
, valid
))
3010 suppress_warning (stmt
, OPT_Winvalid_memory_model
);
3013 /* Check a call STMT to an atomic or sync built-in. */
3016 pass_waccess::check_atomic_builtin (gcall
*stmt
)
3018 tree callee
= gimple_call_fndecl (stmt
);
3022 /* The size in bytes of the access by the function, and the number
3023 of the second argument to check (if any). */
3024 unsigned bytes
= 0, arg2
= UINT_MAX
;
3025 unsigned sucs_arg
= UINT_MAX
, fail_arg
= UINT_MAX
;
3026 /* Points to the array of indices of valid memory models. */
3027 const unsigned char *pvalid_models
= NULL
;
3029 switch (DECL_FUNCTION_CODE (callee
))
3031 #define BUILTIN_ACCESS_SIZE_FNSPEC(N) \
3032 BUILT_IN_SYNC_FETCH_AND_ADD_ ## N: \
3033 case BUILT_IN_SYNC_FETCH_AND_SUB_ ## N: \
3034 case BUILT_IN_SYNC_FETCH_AND_OR_ ## N: \
3035 case BUILT_IN_SYNC_FETCH_AND_AND_ ## N: \
3036 case BUILT_IN_SYNC_FETCH_AND_XOR_ ## N: \
3037 case BUILT_IN_SYNC_FETCH_AND_NAND_ ## N: \
3038 case BUILT_IN_SYNC_ADD_AND_FETCH_ ## N: \
3039 case BUILT_IN_SYNC_SUB_AND_FETCH_ ## N: \
3040 case BUILT_IN_SYNC_OR_AND_FETCH_ ## N: \
3041 case BUILT_IN_SYNC_AND_AND_FETCH_ ## N: \
3042 case BUILT_IN_SYNC_XOR_AND_FETCH_ ## N: \
3043 case BUILT_IN_SYNC_NAND_AND_FETCH_ ## N: \
3044 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_ ## N: \
3045 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_ ## N: \
3046 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_ ## N: \
3047 case BUILT_IN_SYNC_LOCK_RELEASE_ ## N: \
3050 case BUILT_IN_ATOMIC_LOAD_ ## N: \
3051 pvalid_models = load_models; \
3054 case BUILT_IN_ATOMIC_STORE_ ## N: \
3055 if (!pvalid_models) \
3056 pvalid_models = store_models; \
3058 case BUILT_IN_ATOMIC_ADD_FETCH_ ## N: \
3059 case BUILT_IN_ATOMIC_SUB_FETCH_ ## N: \
3060 case BUILT_IN_ATOMIC_AND_FETCH_ ## N: \
3061 case BUILT_IN_ATOMIC_NAND_FETCH_ ## N: \
3062 case BUILT_IN_ATOMIC_XOR_FETCH_ ## N: \
3063 case BUILT_IN_ATOMIC_OR_FETCH_ ## N: \
3064 case BUILT_IN_ATOMIC_FETCH_ADD_ ## N: \
3065 case BUILT_IN_ATOMIC_FETCH_SUB_ ## N: \
3066 case BUILT_IN_ATOMIC_FETCH_AND_ ## N: \
3067 case BUILT_IN_ATOMIC_FETCH_NAND_ ## N: \
3068 case BUILT_IN_ATOMIC_FETCH_OR_ ## N: \
3069 case BUILT_IN_ATOMIC_FETCH_XOR_ ## N: \
3071 if (sucs_arg == UINT_MAX) \
3073 if (!pvalid_models) \
3074 pvalid_models = all_models; \
3076 case BUILT_IN_ATOMIC_EXCHANGE_ ## N: \
3079 pvalid_models = xchg_models; \
3081 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_ ## N: \
3085 pvalid_models = all_models; \
3088 case BUILTIN_ACCESS_SIZE_FNSPEC (1);
3090 case BUILTIN_ACCESS_SIZE_FNSPEC (2);
3092 case BUILTIN_ACCESS_SIZE_FNSPEC (4);
3094 case BUILTIN_ACCESS_SIZE_FNSPEC (8);
3096 case BUILTIN_ACCESS_SIZE_FNSPEC (16);
3099 case BUILT_IN_ATOMIC_CLEAR
:
3101 pvalid_models
= flag_clr_models
;
3108 unsigned nargs
= gimple_call_num_args (stmt
);
3109 if (sucs_arg
< nargs
)
3111 tree ord_sucs
= gimple_call_arg (stmt
, sucs_arg
);
3112 tree ord_fail
= NULL_TREE
;
3113 if (fail_arg
< nargs
)
3114 ord_fail
= gimple_call_arg (stmt
, fail_arg
);
3115 check_atomic_memmodel (stmt
, ord_sucs
, ord_fail
, pvalid_models
);
3121 tree size
= build_int_cstu (sizetype
, bytes
);
3122 tree dst
= gimple_call_arg (stmt
, 0);
3123 check_memop_access (stmt
, dst
, NULL_TREE
, size
);
3125 if (arg2
!= UINT_MAX
)
3127 tree dst
= gimple_call_arg (stmt
, arg2
);
3128 check_memop_access (stmt
, dst
, NULL_TREE
, size
);
3134 /* Check call STMT to a built-in function for invalid accesses. Return
3135 true if a call has been handled. */
3138 pass_waccess::check_builtin (gcall
*stmt
)
3140 tree callee
= gimple_call_fndecl (stmt
);
3144 switch (DECL_FUNCTION_CODE (callee
))
3146 case BUILT_IN_ALLOCA
:
3147 case BUILT_IN_ALLOCA_WITH_ALIGN
:
3148 case BUILT_IN_ALLOCA_WITH_ALIGN_AND_MAX
:
3149 check_alloca (stmt
);
3152 case BUILT_IN_EXECL
:
3153 case BUILT_IN_EXECLE
:
3154 case BUILT_IN_EXECLP
:
3155 case BUILT_IN_EXECV
:
3156 case BUILT_IN_EXECVE
:
3157 case BUILT_IN_EXECVP
:
3158 check_read_access (stmt
, call_arg (stmt
, 0));
3162 case BUILT_IN_REALLOC
:
3163 if (!m_early_checks_p
)
3165 tree arg
= call_arg (stmt
, 0);
3166 if (TREE_CODE (arg
) == SSA_NAME
)
3167 check_pointer_uses (stmt
, arg
);
3171 case BUILT_IN_GETTEXT
:
3173 case BUILT_IN_PUTS_UNLOCKED
:
3174 case BUILT_IN_STRDUP
:
3175 check_read_access (stmt
, call_arg (stmt
, 0));
3178 case BUILT_IN_INDEX
:
3179 case BUILT_IN_RINDEX
:
3180 case BUILT_IN_STRCHR
:
3181 case BUILT_IN_STRRCHR
:
3182 case BUILT_IN_STRLEN
:
3183 check_read_access (stmt
, call_arg (stmt
, 0));
3186 case BUILT_IN_FPUTS
:
3187 case BUILT_IN_FPUTS_UNLOCKED
:
3188 check_read_access (stmt
, call_arg (stmt
, 0));
3191 case BUILT_IN_STRNDUP
:
3192 case BUILT_IN_STRNLEN
:
3194 tree str
= call_arg (stmt
, 0);
3195 tree len
= call_arg (stmt
, 1);
3196 check_read_access (stmt
, str
, len
);
3200 case BUILT_IN_STRCAT
:
3201 check_strcat (stmt
);
3204 case BUILT_IN_STRNCAT
:
3205 check_strncat (stmt
);
3208 case BUILT_IN_STPCPY
:
3209 case BUILT_IN_STRCPY
:
3210 check_stxcpy (stmt
);
3213 case BUILT_IN_STPNCPY
:
3214 case BUILT_IN_STRNCPY
:
3215 check_stxncpy (stmt
);
3218 case BUILT_IN_STRCASECMP
:
3219 case BUILT_IN_STRCMP
:
3220 case BUILT_IN_STRPBRK
:
3221 case BUILT_IN_STRSPN
:
3222 case BUILT_IN_STRCSPN
:
3223 case BUILT_IN_STRSTR
:
3224 check_read_access (stmt
, call_arg (stmt
, 0));
3225 check_read_access (stmt
, call_arg (stmt
, 1));
3228 case BUILT_IN_STRNCASECMP
:
3229 case BUILT_IN_STRNCMP
:
3230 check_strncmp (stmt
);
3233 case BUILT_IN_MEMCMP
:
3235 tree a1
= call_arg (stmt
, 0);
3236 tree a2
= call_arg (stmt
, 1);
3237 tree len
= call_arg (stmt
, 2);
3238 check_read_access (stmt
, a1
, len
, 0);
3239 check_read_access (stmt
, a2
, len
, 0);
3243 case BUILT_IN_MEMCPY
:
3244 case BUILT_IN_MEMPCPY
:
3245 case BUILT_IN_MEMMOVE
:
3247 tree dst
= call_arg (stmt
, 0);
3248 tree src
= call_arg (stmt
, 1);
3249 tree len
= call_arg (stmt
, 2);
3250 check_memop_access (stmt
, dst
, src
, len
);
3254 case BUILT_IN_MEMCHR
:
3256 tree src
= call_arg (stmt
, 0);
3257 tree len
= call_arg (stmt
, 2);
3258 check_read_access (stmt
, src
, len
, 0);
3262 case BUILT_IN_MEMSET
:
3264 tree dst
= call_arg (stmt
, 0);
3265 tree len
= call_arg (stmt
, 2);
3266 check_memop_access (stmt
, dst
, NULL_TREE
, len
);
3271 if (check_atomic_builtin (stmt
))
3279 /* Returns the type of the argument ARGNO to function with type FNTYPE
3280 or null when the type cannot be determined or no such argument exists. */
3283 fntype_argno_type (tree fntype
, unsigned argno
)
3285 if (!prototype_p (fntype
))
3289 function_args_iterator it
;
3290 FOREACH_FUNCTION_ARGS (fntype
, argtype
, it
)
3297 /* Helper to append the "human readable" attribute access specification
3298 described by ACCESS to the array ATTRSTR with size STRSIZE. Used in
3302 append_attrname (const std::pair
<int, attr_access
> &access
,
3303 char *attrstr
, size_t strsize
)
3305 if (access
.second
.internal_p
)
3308 tree str
= access
.second
.to_external_string ();
3309 gcc_assert (strsize
>= (size_t) TREE_STRING_LENGTH (str
));
3310 strcpy (attrstr
, TREE_STRING_POINTER (str
));
3313 /* Iterate over attribute access read-only, read-write, and write-only
3314 arguments and diagnose past-the-end accesses and related problems
3315 in the function call EXP. */
3318 pass_waccess::maybe_check_access_sizes (rdwr_map
*rwm
, tree fndecl
, tree fntype
,
3321 if (warning_suppressed_p (stmt
, OPT_Wnonnull
)
3322 || warning_suppressed_p (stmt
, OPT_Wstringop_overflow_
))
3325 auto_diagnostic_group adg
;
3327 /* Set if a warning has been issued for any argument (used to decide
3328 whether to emit an informational note at the end). */
3329 opt_code opt_warned
= no_warning
;
3331 /* A string describing the attributes that the warnings issued by this
3332 function apply to. Used to print one informational note per function
3333 call, rather than one per warning. That reduces clutter. */
3337 for (rdwr_map::iterator it
= rwm
->begin (); it
!= rwm
->end (); ++it
)
3339 std::pair
<int, attr_access
> access
= *it
;
3341 /* Get the function call arguments corresponding to the attribute's
3342 positional arguments. When both arguments have been specified
3343 there will be two entries in *RWM, one for each. They are
3344 cross-referenced by their respective argument numbers in
3345 ACCESS.PTRARG and ACCESS.SIZARG. */
3346 const int ptridx
= access
.second
.ptrarg
;
3347 const int sizidx
= access
.second
.sizarg
;
3349 gcc_assert (ptridx
!= -1);
3350 gcc_assert (access
.first
== ptridx
|| access
.first
== sizidx
);
3352 /* The pointer is set to null for the entry corresponding to
3353 the size argument. Skip it. It's handled when the entry
3354 corresponding to the pointer argument comes up. */
3355 if (!access
.second
.ptr
)
3358 tree ptrtype
= fntype_argno_type (fntype
, ptridx
);
3360 /* A function with a prototype was redeclared without one and
3361 the prototype has been lost. See pr102759. Avoid dealing
3362 with this pathological case. */
3365 tree argtype
= TREE_TYPE (ptrtype
);
3367 /* The size of the access by the call in elements. */
3371 /* If only the pointer attribute operand was specified and
3372 not size, set SIZE to the greater of MINSIZE or size of
3373 one element of the pointed to type to detect smaller
3374 objects (null pointers are diagnosed in this case only
3375 if the pointer is also declared with attribute nonnull. */
3376 if (access
.second
.minsize
3377 && access
.second
.minsize
!= HOST_WIDE_INT_M1U
)
3378 access_nelts
= build_int_cstu (sizetype
, access
.second
.minsize
);
3379 else if (VOID_TYPE_P (argtype
) && access
.second
.mode
== access_none
)
3380 /* Treat access mode none on a void* argument as expecting
3381 as little as zero bytes. */
3382 access_nelts
= size_zero_node
;
3384 access_nelts
= size_one_node
;
3387 access_nelts
= rwm
->get (sizidx
)->size
;
3389 /* Format the value or range to avoid an explosion of messages. */
3391 tree sizrng
[2] = { size_zero_node
, build_all_ones_cst (sizetype
) };
3392 if (get_size_range (m_ptr_qry
.rvals
, access_nelts
, stmt
, sizrng
, 1))
3394 char *s0
= print_generic_expr_to_str (sizrng
[0]);
3395 if (tree_int_cst_equal (sizrng
[0], sizrng
[1]))
3397 gcc_checking_assert (strlen (s0
) < sizeof sizstr
);
3398 strcpy (sizstr
, s0
);
3402 char *s1
= print_generic_expr_to_str (sizrng
[1]);
3403 gcc_checking_assert (strlen (s0
) + strlen (s1
)
3404 < sizeof sizstr
- 4);
3405 sprintf (sizstr
, "[%.37s, %.37s]", s0
, s1
);
3413 /* Set if a warning has been issued for the current argument. */
3414 opt_code arg_warned
= no_warning
;
3415 location_t loc
= get_location (stmt
);
3416 tree ptr
= access
.second
.ptr
;
3418 && tree_int_cst_sgn (sizrng
[0]) < 0
3419 && tree_int_cst_sgn (sizrng
[1]) < 0)
3421 /* Warn about negative sizes. */
3422 if (access
.second
.internal_p
)
3424 const std::string argtypestr
3425 = access
.second
.array_as_string (ptrtype
);
3427 if (warning_at (loc
, OPT_Wstringop_overflow_
,
3428 "bound argument %i value %s is "
3429 "negative for a variable length array "
3430 "argument %i of type %s",
3432 ptridx
+ 1, argtypestr
.c_str ()))
3433 arg_warned
= OPT_Wstringop_overflow_
;
3435 else if (warning_at (loc
, OPT_Wstringop_overflow_
,
3436 "argument %i value %s is negative",
3437 sizidx
+ 1, sizstr
))
3438 arg_warned
= OPT_Wstringop_overflow_
;
3440 if (arg_warned
!= no_warning
)
3442 append_attrname (access
, attrstr
, sizeof attrstr
);
3443 /* Remember a warning has been issued and avoid warning
3444 again below for the same attribute. */
3445 opt_warned
= arg_warned
;
3450 /* The size of the access by the call in bytes. */
3451 tree access_size
= NULL_TREE
;
3452 if (tree_int_cst_sgn (sizrng
[0]) >= 0)
3454 if (COMPLETE_TYPE_P (argtype
))
3456 /* Multiply ACCESS_SIZE by the size of the type the pointer
3457 argument points to. If it's incomplete the size is used
3459 if (tree argsize
= TYPE_SIZE_UNIT (argtype
))
3460 if (TREE_CODE (argsize
) == INTEGER_CST
)
3462 const int prec
= TYPE_PRECISION (sizetype
);
3463 wide_int minsize
= wi::to_wide (sizrng
[0], prec
);
3464 minsize
*= wi::to_wide (argsize
, prec
);
3465 access_size
= wide_int_to_tree (sizetype
, minsize
);
3469 access_size
= access_nelts
;
3472 if (integer_zerop (ptr
))
3474 if (sizidx
>= 0 && tree_int_cst_sgn (sizrng
[0]) > 0)
3476 /* Warn about null pointers with positive sizes. This is
3477 different from also declaring the pointer argument with
3478 attribute nonnull when the function accepts null pointers
3479 only when the corresponding size is zero. */
3480 if (access
.second
.internal_p
)
3482 const std::string argtypestr
3483 = access
.second
.array_as_string (ptrtype
);
3485 if (warning_at (loc
, OPT_Wnonnull
,
3486 "argument %i of variable length "
3487 "array %s is null but "
3488 "the corresponding bound argument "
3490 ptridx
+ 1, argtypestr
.c_str (),
3491 sizidx
+ 1, sizstr
))
3492 arg_warned
= OPT_Wnonnull
;
3494 else if (warning_at (loc
, OPT_Wnonnull
,
3495 "argument %i is null but "
3496 "the corresponding size argument "
3498 ptridx
+ 1, sizidx
+ 1, sizstr
))
3499 arg_warned
= OPT_Wnonnull
;
3501 else if (access_size
&& access
.second
.static_p
)
3503 /* Warn about null pointers for [static N] array arguments
3504 but do not warn for ordinary (i.e., nonstatic) arrays. */
3505 if (warning_at (loc
, OPT_Wnonnull
,
3506 "argument %i to %<%T[static %E]%> "
3507 "is null where non-null expected",
3508 ptridx
+ 1, argtype
, access_nelts
))
3509 arg_warned
= OPT_Wnonnull
;
3512 if (arg_warned
!= no_warning
)
3514 append_attrname (access
, attrstr
, sizeof attrstr
);
3515 /* Remember a warning has been issued and avoid warning
3516 again below for the same attribute. */
3517 opt_warned
= OPT_Wnonnull
;
3522 access_data
data (m_ptr_qry
.rvals
, stmt
, access
.second
.mode
,
3523 NULL_TREE
, false, NULL_TREE
, false);
3524 access_ref
* const pobj
= (access
.second
.mode
== access_write_only
3525 ? &data
.dst
: &data
.src
);
3526 tree objsize
= compute_objsize (ptr
, stmt
, 1, pobj
, &m_ptr_qry
);
3528 /* The size of the destination or source object. */
3529 tree dstsize
= NULL_TREE
, srcsize
= NULL_TREE
;
3530 if (access
.second
.mode
== access_read_only
3531 || access
.second
.mode
== access_none
)
3533 /* For a read-only argument there is no destination. For
3534 no access, set the source as well and differentiate via
3535 the access flag below. */
3537 if (access
.second
.mode
== access_read_only
3538 || access
.second
.mode
== access_none
)
3540 /* For a read-only attribute there is no destination so
3541 clear OBJSIZE. This emits "reading N bytes" kind of
3542 diagnostics instead of the "writing N bytes" kind,
3543 unless MODE is none. */
3544 objsize
= NULL_TREE
;
3550 /* Clear the no-warning bit in case it was set by check_access
3551 in a prior iteration so that accesses via different arguments
3553 suppress_warning (stmt
, OPT_Wstringop_overflow_
, false);
3554 access_mode mode
= data
.mode
;
3555 if (mode
== access_deferred
)
3556 mode
= TYPE_READONLY (argtype
) ? access_read_only
: access_read_write
;
3557 check_access (stmt
, access_size
, /*maxread=*/ NULL_TREE
, srcsize
,
3558 dstsize
, mode
, &data
, m_ptr_qry
.rvals
);
3560 if (warning_suppressed_p (stmt
, OPT_Wstringop_overflow_
))
3561 opt_warned
= OPT_Wstringop_overflow_
;
3562 if (opt_warned
!= no_warning
)
3564 if (access
.second
.internal_p
)
3566 unsigned HOST_WIDE_INT nelts
=
3567 access_nelts
? access
.second
.minsize
: HOST_WIDE_INT_M1U
;
3568 tree arrtype
= build_printable_array_type (argtype
, nelts
);
3569 inform (loc
, "referencing argument %u of type %qT",
3570 ptridx
+ 1, arrtype
);
3573 /* If check_access issued a warning above, append the relevant
3574 attribute to the string. */
3575 append_attrname (access
, attrstr
, sizeof attrstr
);
3582 inform (get_location (fndecl
),
3583 "in a call to function %qD declared with attribute %qs",
3586 inform (get_location (stmt
),
3587 "in a call with type %qT and attribute %qs",
3590 else if (opt_warned
!= no_warning
)
3593 inform (get_location (fndecl
),
3594 "in a call to function %qD", fndecl
);
3596 inform (get_location (stmt
),
3597 "in a call with type %qT", fntype
);
3600 /* Set the bit in case it was cleared and not set above. */
3601 if (opt_warned
!= no_warning
)
3602 suppress_warning (stmt
, opt_warned
);
3605 /* Check call STMT to an ordinary (non-built-in) function for invalid
3606 accesses. Return true if a call has been handled. */
3609 pass_waccess::check_call_access (gcall
*stmt
)
3611 tree fntype
= gimple_call_fntype (stmt
);
3615 tree fntypeattrs
= TYPE_ATTRIBUTES (fntype
);
3619 /* Map of attribute access specifications for function arguments. */
3621 init_attr_rdwr_indices (&rdwr_idx
, fntypeattrs
);
3623 unsigned nargs
= call_nargs (stmt
);
3624 for (unsigned i
= 0; i
!= nargs
; ++i
)
3626 tree arg
= call_arg (stmt
, i
);
3628 /* Save the actual argument that corresponds to the access attribute
3629 operand for later processing. */
3630 if (attr_access
*access
= rdwr_idx
.get (i
))
3632 if (POINTER_TYPE_P (TREE_TYPE (arg
)))
3635 /* A nonnull ACCESS->SIZE contains VLA bounds. */
3640 gcc_assert (access
->ptr
== NULL_TREE
);
3645 /* Check attribute access arguments. */
3646 tree fndecl
= gimple_call_fndecl (stmt
);
3647 maybe_check_access_sizes (&rdwr_idx
, fndecl
, fntype
, stmt
);
3649 check_alloc_size_call (stmt
);
3653 /* Check arguments in a call STMT for attribute nonstring. */
3656 check_nonstring_args (gcall
*stmt
)
3658 tree fndecl
= gimple_call_fndecl (stmt
);
3660 /* Detect passing non-string arguments to functions expecting
3661 nul-terminated strings. */
3662 maybe_warn_nonstring_arg (fndecl
, stmt
);
3665 /* Issue a warning if a deallocation function such as free, realloc,
3666 or C++ operator delete is called with an argument not returned by
3667 a matching allocation function such as malloc or the corresponding
3668 form of C++ operator new. */
3671 pass_waccess::maybe_check_dealloc_call (gcall
*call
)
3673 tree fndecl
= gimple_call_fndecl (call
);
3677 unsigned argno
= fndecl_dealloc_argno (fndecl
);
3678 if ((unsigned) call_nargs (call
) <= argno
)
3681 tree ptr
= gimple_call_arg (call
, argno
);
3682 if (integer_zerop (ptr
))
3686 if (!compute_objsize (ptr
, call
, 0, &aref
, &m_ptr_qry
))
3689 tree ref
= aref
.ref
;
3690 if (integer_zerop (ref
))
3693 tree dealloc_decl
= fndecl
;
3694 location_t loc
= gimple_location (call
);
3696 if (DECL_P (ref
) || EXPR_P (ref
))
3698 /* Diagnose freeing a declared object. */
3699 if (aref
.ref_declared ())
3701 auto_diagnostic_group d
;
3702 if (warning_at (loc
, OPT_Wfree_nonheap_object
,
3703 "%qD called on unallocated object %qD",
3706 inform (get_location (ref
), "declared here");
3711 /* Diagnose freeing a pointer that includes a positive offset.
3712 Such a pointer cannot refer to the beginning of an allocated
3713 object. A negative offset may refer to it. */
3714 if (aref
.sizrng
[0] != aref
.sizrng
[1]
3715 && warn_dealloc_offset (loc
, call
, aref
))
3718 else if (CONSTANT_CLASS_P (ref
))
3720 auto_diagnostic_group d
;
3721 if (warning_at (loc
, OPT_Wfree_nonheap_object
,
3722 "%qD called on a pointer to an unallocated "
3723 "object %qE", dealloc_decl
, ref
))
3725 if (TREE_CODE (ptr
) == SSA_NAME
)
3727 gimple
*def_stmt
= SSA_NAME_DEF_STMT (ptr
);
3728 if (is_gimple_assign (def_stmt
))
3730 location_t loc
= gimple_location (def_stmt
);
3731 inform (loc
, "assigned here");
3737 else if (TREE_CODE (ref
) == SSA_NAME
)
3739 /* Also warn if the pointer argument refers to the result
3740 of an allocation call like alloca or VLA. */
3741 gimple
*def_stmt
= SSA_NAME_DEF_STMT (ref
);
3745 if (is_gimple_call (def_stmt
))
3747 bool warned
= false;
3748 if (gimple_call_alloc_p (def_stmt
))
3750 if (matching_alloc_calls_p (def_stmt
, dealloc_decl
))
3752 if (warn_dealloc_offset (loc
, call
, aref
))
3757 tree alloc_decl
= gimple_call_fndecl (def_stmt
);
3758 const opt_code opt
=
3759 (DECL_IS_OPERATOR_NEW_P (alloc_decl
)
3760 || DECL_IS_OPERATOR_DELETE_P (dealloc_decl
)
3761 ? OPT_Wmismatched_new_delete
3762 : OPT_Wmismatched_dealloc
);
3763 warned
= warning_at (loc
, opt
,
3764 "%qD called on pointer returned "
3765 "from a mismatched allocation "
3766 "function", dealloc_decl
);
3769 else if (gimple_call_builtin_p (def_stmt
, BUILT_IN_ALLOCA
)
3770 || gimple_call_builtin_p (def_stmt
,
3771 BUILT_IN_ALLOCA_WITH_ALIGN
))
3772 warned
= warning_at (loc
, OPT_Wfree_nonheap_object
,
3773 "%qD called on pointer to "
3774 "an unallocated object",
3776 else if (warn_dealloc_offset (loc
, call
, aref
))
3781 tree fndecl
= gimple_call_fndecl (def_stmt
);
3782 inform (gimple_location (def_stmt
),
3783 "returned from %qD", fndecl
);
3787 else if (gimple_nop_p (def_stmt
))
3789 ref
= SSA_NAME_VAR (ref
);
3790 /* Diagnose freeing a pointer that includes a positive offset. */
3791 if (TREE_CODE (ref
) == PARM_DECL
3793 && aref
.sizrng
[0] != aref
.sizrng
[1]
3794 && aref
.offrng
[0] > 0 && aref
.offrng
[1] > 0
3795 && warn_dealloc_offset (loc
, call
, aref
))
3801 /* Return true if either USE_STMT's basic block (that of a pointer's use)
3802 is dominated by INVAL_STMT's (that of a pointer's invalidating statement,
3803 which is either a clobber or a deallocation call), or if they're in
3804 the same block, USE_STMT follows INVAL_STMT. */
3807 pass_waccess::use_after_inval_p (gimple
*inval_stmt
, gimple
*use_stmt
,
3808 bool last_block
/* = false */)
3811 gimple_clobber_p (inval_stmt
) ? gimple_assign_lhs (inval_stmt
) : NULL_TREE
;
3813 basic_block inval_bb
= gimple_bb (inval_stmt
);
3814 basic_block use_bb
= gimple_bb (use_stmt
);
3816 if (!inval_bb
|| !use_bb
)
3819 if (inval_bb
!= use_bb
)
3821 if (dominated_by_p (CDI_DOMINATORS
, use_bb
, inval_bb
))
3824 if (!clobvar
|| !last_block
)
3827 /* Proceed only when looking for uses of dangling pointers. */
3828 auto gsi
= gsi_for_stmt (use_stmt
);
3830 /* A use statement in the last basic block in a function or one that
3831 falls through to it is after any other prior clobber of the used
3832 variable unless it's followed by a clobber of the same variable. */
3833 basic_block bb
= use_bb
;
3834 while (bb
!= inval_bb
3835 && single_succ_p (bb
)
3836 && !(single_succ_edge (bb
)->flags
3837 & (EDGE_EH
| EDGE_ABNORMAL
| EDGE_DFS_BACK
)))
3839 for (; !gsi_end_p (gsi
); gsi_next_nondebug (&gsi
))
3841 gimple
*stmt
= gsi_stmt (gsi
);
3842 if (gimple_clobber_p (stmt
))
3844 if (clobvar
== gimple_assign_lhs (stmt
))
3845 /* The use is followed by a clobber. */
3850 bb
= single_succ (bb
);
3851 gsi
= gsi_start_bb (bb
);
3854 /* The use is one of a dangling pointer if a clobber of the variable
3855 [the pointer points to] has not been found before the function exit
3857 return bb
== EXIT_BLOCK_PTR_FOR_FN (cfun
);
3860 if (bitmap_set_bit (m_bb_uids_set
, inval_bb
->index
))
3861 /* The first time this basic block is visited assign increasing ids
3862 to consecutive statements in it. Use the ids to determine which
3863 precedes which. This avoids the linear traversal on subsequent
3864 visits to the same block. */
3865 for (auto si
= gsi_start_bb (inval_bb
); !gsi_end_p (si
);
3866 gsi_next_nondebug (&si
))
3868 gimple
*stmt
= gsi_stmt (si
);
3869 unsigned uid
= inc_gimple_stmt_max_uid (m_func
);
3870 gimple_set_uid (stmt
, uid
);
3873 return gimple_uid (inval_stmt
) < gimple_uid (use_stmt
);
3876 /* Issue a warning for the USE_STMT of pointer or reference REF rendered
3877 invalid by INVAL_STMT. REF may be null when it's been optimized away.
3878 When nonnull, INVAL_STMT is the deallocation function that rendered
3879 the pointer or reference dangling. Otherwise, VAR is the auto variable
3880 (including an unnamed temporary such as a compound literal) whose
3881 lifetime's rended it dangling. MAYBE is true to issue the "maybe"
3882 kind of warning. EQUALITY is true when the pointer is used in
3883 an equality expression. */
3886 pass_waccess::warn_invalid_pointer (tree ref
, gimple
*use_stmt
,
3887 gimple
*inval_stmt
, tree var
,
3888 bool maybe
, bool equality
/* = false */)
3890 /* Avoid printing the unhelpful "<unknown>" in the diagnostics. */
3891 if (ref
&& TREE_CODE (ref
) == SSA_NAME
)
3893 tree var
= SSA_NAME_VAR (ref
);
3896 /* Don't warn for cases like when a cdtor returns 'this' on ARM. */
3897 else if (warning_suppressed_p (var
, OPT_Wuse_after_free
))
3899 else if (DECL_ARTIFICIAL (var
))
3903 location_t use_loc
= gimple_location (use_stmt
);
3904 if (use_loc
== UNKNOWN_LOCATION
)
3906 use_loc
= m_func
->function_end_locus
;
3908 /* Avoid issuing a warning with no context other than
3909 the function. That would make it difficult to debug
3910 in any but very simple cases. */
3914 if (is_gimple_call (inval_stmt
))
3916 if ((equality
&& warn_use_after_free
< 3)
3917 || (maybe
&& warn_use_after_free
< 2)
3918 || warning_suppressed_p (use_stmt
, OPT_Wuse_after_free
))
3921 const tree inval_decl
= gimple_call_fndecl (inval_stmt
);
3923 auto_diagnostic_group d
;
3924 if ((ref
&& warning_at (use_loc
, OPT_Wuse_after_free
,
3926 ? G_("pointer %qE may be used after %qD")
3927 : G_("pointer %qE used after %qD")),
3929 || (!ref
&& warning_at (use_loc
, OPT_Wuse_after_free
,
3931 ? G_("pointer may be used after %qD")
3932 : G_("pointer used after %qD")),
3935 location_t loc
= gimple_location (inval_stmt
);
3936 inform (loc
, "call to %qD here", inval_decl
);
3937 suppress_warning (use_stmt
, OPT_Wuse_after_free
);
3943 || (maybe
&& warn_dangling_pointer
< 2)
3944 || warning_suppressed_p (use_stmt
, OPT_Wdangling_pointer_
))
3947 if (DECL_NAME (var
))
3949 auto_diagnostic_group d
;
3951 && warning_at (use_loc
, OPT_Wdangling_pointer_
,
3953 ? G_("dangling pointer %qE to %qD may be used")
3954 : G_("using dangling pointer %qE to %qD")),
3957 && warning_at (use_loc
, OPT_Wdangling_pointer_
,
3959 ? G_("dangling pointer to %qD may be used")
3960 : G_("using a dangling pointer to %qD")),
3962 inform (DECL_SOURCE_LOCATION (var
),
3963 "%qD declared here", var
);
3964 suppress_warning (use_stmt
, OPT_Wdangling_pointer_
);
3969 && warning_at (use_loc
, OPT_Wdangling_pointer_
,
3971 ? G_("dangling pointer %qE to an unnamed temporary "
3973 : G_("using dangling pointer %qE to an unnamed "
3977 && warning_at (use_loc
, OPT_Wdangling_pointer_
,
3979 ? G_("dangling pointer to an unnamed temporary "
3981 : G_("using a dangling pointer to an unnamed "
3984 inform (DECL_SOURCE_LOCATION (var
),
3985 "unnamed temporary defined here");
3986 suppress_warning (use_stmt
, OPT_Wdangling_pointer_
);
3990 /* If STMT is a call to either the standard realloc or to a user-defined
3991 reallocation function returns its LHS and set *PTR to the reallocated
3992 pointer. Otherwise return null. */
3995 get_realloc_lhs (gimple
*stmt
, tree
*ptr
)
3997 if (gimple_call_builtin_p (stmt
, BUILT_IN_REALLOC
))
3999 *ptr
= gimple_call_arg (stmt
, 0);
4000 return gimple_call_lhs (stmt
);
4003 gcall
*call
= dyn_cast
<gcall
*>(stmt
);
4007 tree fnattr
= NULL_TREE
;
4008 tree fndecl
= gimple_call_fndecl (call
);
4010 fnattr
= DECL_ATTRIBUTES (fndecl
);
4013 tree fntype
= gimple_call_fntype (stmt
);
4016 fnattr
= TYPE_ATTRIBUTES (fntype
);
4022 for (tree ats
= fnattr
; (ats
= lookup_attribute ("*dealloc", ats
));
4023 ats
= TREE_CHAIN (ats
))
4025 tree args
= TREE_VALUE (ats
);
4029 tree alloc
= TREE_VALUE (args
);
4033 if (alloc
== DECL_NAME (fndecl
))
4036 if (tree index
= TREE_CHAIN (args
))
4037 argno
= TREE_INT_CST_LOW (TREE_VALUE (index
)) - 1;
4038 *ptr
= gimple_call_arg (stmt
, argno
);
4039 return gimple_call_lhs (stmt
);
4046 /* Warn if STMT is a call to a deallocation function that's not a match
4047 for the REALLOC_STMT call. Return true if warned. */
4050 maybe_warn_mismatched_realloc (tree ptr
, gimple
*realloc_stmt
, gimple
*stmt
)
4052 if (!is_gimple_call (stmt
))
4055 tree fndecl
= gimple_call_fndecl (stmt
);
4059 unsigned argno
= fndecl_dealloc_argno (fndecl
);
4060 if (call_nargs (stmt
) <= argno
)
4063 if (matching_alloc_calls_p (realloc_stmt
, fndecl
))
4066 /* Avoid printing the unhelpful "<unknown>" in the diagnostics. */
4067 if (ptr
&& TREE_CODE (ptr
) == SSA_NAME
4068 && (!SSA_NAME_VAR (ptr
) || DECL_ARTIFICIAL (SSA_NAME_VAR (ptr
))))
4071 location_t loc
= gimple_location (stmt
);
4072 tree realloc_decl
= gimple_call_fndecl (realloc_stmt
);
4073 tree dealloc_decl
= gimple_call_fndecl (stmt
);
4074 if (ptr
&& !warning_at (loc
, OPT_Wmismatched_dealloc
,
4075 "%qD called on pointer %qE passed to mismatched "
4076 "allocation function %qD",
4077 dealloc_decl
, ptr
, realloc_decl
))
4079 if (!ptr
&& !warning_at (loc
, OPT_Wmismatched_dealloc
,
4080 "%qD called on a pointer passed to mismatched "
4081 "reallocation function %qD",
4082 dealloc_decl
, realloc_decl
))
4085 inform (gimple_location (realloc_stmt
),
4086 "call to %qD", realloc_decl
);
4090 /* Return true if P and Q point to the same object, and false if they
4091 either don't or their relationship cannot be determined. */
4094 pointers_related_p (gimple
*stmt
, tree p
, tree q
, pointer_query
&qry
,
4095 auto_bitmap
&visited
)
4097 if (!ptr_derefs_may_alias_p (p
, q
))
4100 /* TODO: Work harder to rule out relatedness. */
4101 access_ref pref
, qref
;
4102 if (!qry
.get_ref (p
, stmt
, &pref
, 0)
4103 || !qry
.get_ref (q
, stmt
, &qref
, 0))
4104 /* GET_REF() only rarely fails. When it does, it's likely because
4105 it involves a self-referential PHI. Return a conservative result. */
4108 if (pref
.ref
== qref
.ref
)
4111 /* If either pointer is a PHI, iterate over all its operands and
4112 return true if they're all related to the other pointer. */
4115 gphi
*phi
= pref
.phi ();
4117 version
= SSA_NAME_VERSION (pref
.ref
);
4125 version
= SSA_NAME_VERSION (qref
.ref
);
4128 if (!bitmap_set_bit (visited
, version
))
4131 unsigned nargs
= gimple_phi_num_args (phi
);
4132 for (unsigned i
= 0; i
!= nargs
; ++i
)
4134 tree arg
= gimple_phi_arg_def (phi
, i
);
4135 if (!pointers_related_p (stmt
, arg
, ptr
, qry
, visited
))
4142 /* Convenience wrapper for the above. */
4145 pointers_related_p (gimple
*stmt
, tree p
, tree q
, pointer_query
&qry
)
4147 auto_bitmap visited
;
4148 return pointers_related_p (stmt
, p
, q
, qry
, visited
);
4151 /* For a STMT either a call to a deallocation function or a clobber, warn
4152 for uses of the pointer PTR it was called with (including its copies
4153 or others derived from it by pointer arithmetic). If STMT is a clobber,
4154 VAR is the decl of the clobbered variable. When MAYBE is true use
4155 a "maybe" form of diagnostic. */
4158 pass_waccess::check_pointer_uses (gimple
*stmt
, tree ptr
,
4159 tree var
/* = NULL_TREE */,
4160 bool maybe
/* = false */)
4162 gcc_assert (TREE_CODE (ptr
) == SSA_NAME
);
4164 const bool check_dangling
= !is_gimple_call (stmt
);
4165 basic_block stmt_bb
= gimple_bb (stmt
);
4167 /* If STMT is a reallocation function set to the reallocated pointer
4168 and the LHS of the call, respectively. */
4169 tree realloc_ptr
= NULL_TREE
;
4170 tree realloc_lhs
= get_realloc_lhs (stmt
, &realloc_ptr
);
4172 auto_bitmap visited
;
4174 auto_vec
<tree
> pointers
;
4175 pointers
.safe_push (ptr
);
4177 /* Starting with PTR, iterate over POINTERS added by the loop, and
4178 either warn for their uses in basic blocks dominated by the STMT
4179 or in statements that follow it in the same basic block, or add
4180 them to POINTERS if they point into the same object as PTR (i.e.,
4181 are obtained by pointer arithmetic on PTR). */
4182 for (unsigned i
= 0; i
!= pointers
.length (); ++i
)
4184 tree ptr
= pointers
[i
];
4185 if (!bitmap_set_bit (visited
, SSA_NAME_VERSION (ptr
)))
4186 /* Avoid revisiting the same pointer. */
4189 use_operand_p use_p
;
4190 imm_use_iterator iter
;
4191 FOR_EACH_IMM_USE_FAST (use_p
, iter
, ptr
)
4193 gimple
*use_stmt
= USE_STMT (use_p
);
4194 if (use_stmt
== stmt
|| is_gimple_debug (use_stmt
))
4199 /* Check to see if USE_STMT is a mismatched deallocation
4200 call for the pointer passed to realloc. That's a bug
4201 regardless of the pointer's value and so warn. */
4202 if (maybe_warn_mismatched_realloc (*use_p
->use
, stmt
, use_stmt
))
4205 /* Pointers passed to realloc that are used in basic blocks
4206 where the realloc call is known to have failed are valid.
4207 Ignore pointers that nothing is known about. Those could
4208 have escaped along with their nullness. */
4210 if (m_ptr_qry
.rvals
->range_of_expr (vr
, realloc_lhs
, use_stmt
))
4215 if (!pointers_related_p (stmt
, ptr
, realloc_ptr
, m_ptr_qry
))
4221 && gimple_code (use_stmt
) == GIMPLE_RETURN
)
4222 /* Avoid interfering with -Wreturn-local-addr (which runs only
4223 with optimization enabled so it won't diagnose cases that
4224 would be caught here when optimization is disabled). */
4227 bool equality
= false;
4228 if (is_gimple_assign (use_stmt
))
4230 tree_code code
= gimple_assign_rhs_code (use_stmt
);
4231 equality
= code
== EQ_EXPR
|| code
== NE_EXPR
;
4233 else if (gcond
*cond
= dyn_cast
<gcond
*>(use_stmt
))
4235 tree_code code
= gimple_cond_code (cond
);
4236 equality
= code
== EQ_EXPR
|| code
== NE_EXPR
;
4239 /* Warn if USE_STMT is dominated by the deallocation STMT.
4240 Otherwise, add the pointer to POINTERS so that the uses
4241 of any other pointers derived from it can be checked. */
4242 if (use_after_inval_p (stmt
, use_stmt
, check_dangling
))
4244 if (gimple_code (use_stmt
) == GIMPLE_PHI
)
4246 /* Only add a PHI result to POINTERS if all its
4247 operands are related to PTR, otherwise continue. */
4248 tree lhs
= gimple_phi_result (use_stmt
);
4249 if (!pointers_related_p (stmt
, lhs
, ptr
, m_ptr_qry
))
4252 if (TREE_CODE (lhs
) == SSA_NAME
)
4254 pointers
.safe_push (lhs
);
4259 basic_block use_bb
= gimple_bb (use_stmt
);
4262 || !dominated_by_p (CDI_POST_DOMINATORS
, stmt_bb
, use_bb
));
4263 warn_invalid_pointer (*use_p
->use
, use_stmt
, stmt
, var
,
4264 this_maybe
, equality
);
4268 if (is_gimple_assign (use_stmt
))
4270 tree lhs
= gimple_assign_lhs (use_stmt
);
4271 if (TREE_CODE (lhs
) == SSA_NAME
)
4273 tree_code rhs_code
= gimple_assign_rhs_code (use_stmt
);
4274 if (rhs_code
== POINTER_PLUS_EXPR
|| rhs_code
== SSA_NAME
)
4275 pointers
.safe_push (lhs
);
4280 if (gcall
*call
= dyn_cast
<gcall
*>(use_stmt
))
4282 if (gimple_call_return_arg (call
) == ptr
)
4283 if (tree lhs
= gimple_call_lhs (call
))
4284 if (TREE_CODE (lhs
) == SSA_NAME
)
4285 pointers
.safe_push (lhs
);
4292 /* Check call STMT for invalid accesses. */
4295 pass_waccess::check_call (gcall
*stmt
)
4297 /* Skip special calls generated by the compiler. */
4298 if (gimple_call_from_thunk_p (stmt
))
4301 /* .ASAN_MARK doesn't access any vars, only modifies shadow memory. */
4302 if (gimple_call_internal_p (stmt
)
4303 && gimple_call_internal_fn (stmt
) == IFN_ASAN_MARK
)
4306 if (gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
))
4307 check_builtin (stmt
);
4309 if (!m_early_checks_p
)
4310 if (tree callee
= gimple_call_fndecl (stmt
))
4312 /* Check for uses of the pointer passed to either a standard
4313 or a user-defined deallocation function. */
4314 unsigned argno
= fndecl_dealloc_argno (callee
);
4315 if (argno
< (unsigned) call_nargs (stmt
))
4317 tree arg
= call_arg (stmt
, argno
);
4318 if (TREE_CODE (arg
) == SSA_NAME
)
4319 check_pointer_uses (stmt
, arg
);
4323 check_call_access (stmt
);
4324 check_call_dangling (stmt
);
4326 if (m_early_checks_p
)
4329 maybe_check_dealloc_call (stmt
);
4330 check_nonstring_args (stmt
);
4333 /* Check non-call STMT for invalid accesses. */
4336 pass_waccess::check_stmt (gimple
*stmt
)
4338 if (m_check_dangling_p
4339 && gimple_clobber_p (stmt
, CLOBBER_EOL
))
4341 /* Ignore clobber statements in blocks with exceptional edges. */
4342 basic_block bb
= gimple_bb (stmt
);
4343 edge e
= EDGE_PRED (bb
, 0);
4344 if (e
->flags
& EDGE_EH
)
4347 tree var
= gimple_assign_lhs (stmt
);
4348 m_clobbers
.put (var
, stmt
);
4352 if (is_gimple_assign (stmt
))
4354 /* Clobbered unnamed temporaries such as compound literals can be
4355 revived. Check for an assignment to one and remove it from
4357 tree lhs
= gimple_assign_lhs (stmt
);
4358 while (handled_component_p (lhs
))
4359 lhs
= TREE_OPERAND (lhs
, 0);
4361 if (auto_var_p (lhs
))
4362 m_clobbers
.remove (lhs
);
4366 if (greturn
*ret
= dyn_cast
<greturn
*> (stmt
))
4368 if (optimize
&& flag_isolate_erroneous_paths_dereference
)
4369 /* Avoid interfering with -Wreturn-local-addr (which runs only
4370 with optimization enabled). */
4373 tree arg
= gimple_return_retval (ret
);
4374 if (!arg
|| TREE_CODE (arg
) != ADDR_EXPR
)
4377 arg
= TREE_OPERAND (arg
, 0);
4378 while (handled_component_p (arg
))
4379 arg
= TREE_OPERAND (arg
, 0);
4381 if (!auto_var_p (arg
))
4384 gimple
**pclobber
= m_clobbers
.get (arg
);
4388 if (!use_after_inval_p (*pclobber
, stmt
))
4391 warn_invalid_pointer (NULL_TREE
, stmt
, *pclobber
, arg
, false);
4395 /* Check basic block BB for invalid accesses. */
4398 pass_waccess::check_block (basic_block bb
)
4400 /* Iterate over statements, looking for function calls. */
4401 for (auto si
= gsi_start_bb (bb
); !gsi_end_p (si
);
4402 gsi_next_nondebug (&si
))
4404 gimple
*stmt
= gsi_stmt (si
);
4405 if (gcall
*call
= dyn_cast
<gcall
*> (stmt
))
4412 /* Return the argument that the call STMT to a built-in function returns
4413 (including with an offset) or null if it doesn't. */
4416 pass_waccess::gimple_call_return_arg (gcall
*call
)
4418 /* Check for attribute fn spec to see if the function returns one
4419 of its arguments. */
4420 attr_fnspec fnspec
= gimple_call_fnspec (call
);
4422 if (!fnspec
.returns_arg (&argno
))
4424 if (gimple_call_num_args (call
) < 1)
4427 if (!gimple_call_builtin_p (call
, BUILT_IN_NORMAL
))
4430 tree fndecl
= gimple_call_fndecl (call
);
4431 switch (DECL_FUNCTION_CODE (fndecl
))
4433 case BUILT_IN_MEMPCPY
:
4434 case BUILT_IN_MEMPCPY_CHK
:
4435 case BUILT_IN_MEMCHR
:
4436 case BUILT_IN_STRCHR
:
4437 case BUILT_IN_STRRCHR
:
4438 case BUILT_IN_STRSTR
:
4439 case BUILT_IN_STPCPY
:
4440 case BUILT_IN_STPCPY_CHK
:
4441 case BUILT_IN_STPNCPY
:
4442 case BUILT_IN_STPNCPY_CHK
:
4451 if (gimple_call_num_args (call
) <= argno
)
4454 return gimple_call_arg (call
, argno
);
4457 /* Check for and diagnose all uses of the dangling pointer VAR to the auto
4458 object DECL whose lifetime has ended. OBJREF is true when VAR denotes
4459 an access to a DECL that may have been clobbered. */
4462 pass_waccess::check_dangling_uses (tree var
, tree decl
, bool maybe
/* = false */,
4463 bool objref
/* = false */)
4465 if (!decl
|| !auto_var_p (decl
))
4468 gimple
**pclob
= m_clobbers
.get (decl
);
4474 check_pointer_uses (*pclob
, var
, decl
, maybe
);
4478 gimple
*use_stmt
= SSA_NAME_DEF_STMT (var
);
4479 if (!use_after_inval_p (*pclob
, use_stmt
, true))
4482 basic_block use_bb
= gimple_bb (use_stmt
);
4483 basic_block clob_bb
= gimple_bb (*pclob
);
4484 maybe
= maybe
|| !dominated_by_p (CDI_POST_DOMINATORS
, clob_bb
, use_bb
);
4485 warn_invalid_pointer (var
, use_stmt
, *pclob
, decl
, maybe
, false);
4488 /* Diagnose stores in BB and (recursively) its predecessors of the addresses
4489 of local variables into nonlocal pointers that are left dangling after
4490 the function returns. BBS is a bitmap of basic blocks visited. */
4493 pass_waccess::check_dangling_stores (basic_block bb
,
4494 hash_set
<tree
> &stores
,
4497 if (!bitmap_set_bit (bbs
, bb
->index
))
4501 /* Iterate backwards over the statements looking for a store of
4502 the address of a local variable into a nonlocal pointer. */
4503 for (auto gsi
= gsi_last_nondebug_bb (bb
); ; gsi_prev_nondebug (&gsi
))
4505 gimple
*stmt
= gsi_stmt (gsi
);
4509 if (warning_suppressed_p (stmt
, OPT_Wdangling_pointer_
))
4512 if (is_gimple_call (stmt
)
4513 && !(gimple_call_flags (stmt
) & (ECF_CONST
| ECF_PURE
)))
4514 /* Avoid looking before nonconst, nonpure calls since those might
4515 use the escaped locals. */
4518 if (!is_gimple_assign (stmt
) || gimple_clobber_p (stmt
)
4519 || !gimple_store_p (stmt
))
4523 tree lhs
= gimple_assign_lhs (stmt
);
4524 if (!m_ptr_qry
.get_ref (lhs
, stmt
, &lhs_ref
, 0))
4527 if (auto_var_p (lhs_ref
.ref
))
4530 if (DECL_P (lhs_ref
.ref
))
4532 if (!POINTER_TYPE_P (TREE_TYPE (lhs_ref
.ref
))
4533 || lhs_ref
.deref
> 0)
4536 else if (TREE_CODE (lhs_ref
.ref
) == SSA_NAME
)
4538 gimple
*def_stmt
= SSA_NAME_DEF_STMT (lhs_ref
.ref
);
4539 if (!gimple_nop_p (def_stmt
))
4540 /* Avoid looking at or before stores into unknown objects. */
4543 tree var
= SSA_NAME_VAR (lhs_ref
.ref
);
4544 if (TREE_CODE (var
) == PARM_DECL
&& DECL_BY_REFERENCE (var
))
4545 /* Avoid by-value arguments transformed into by-reference. */
4549 else if (TREE_CODE (lhs_ref
.ref
) == MEM_REF
)
4551 tree arg
= TREE_OPERAND (lhs_ref
.ref
, 0);
4552 if (TREE_CODE (arg
) == SSA_NAME
)
4554 gimple
*def_stmt
= SSA_NAME_DEF_STMT (arg
);
4555 if (!gimple_nop_p (def_stmt
))
4562 if (stores
.add (lhs_ref
.ref
))
4565 /* FIXME: Handle stores of alloca() and VLA. */
4567 tree rhs
= gimple_assign_rhs1 (stmt
);
4568 if (!m_ptr_qry
.get_ref (rhs
, stmt
, &rhs_ref
, 0)
4569 || rhs_ref
.deref
!= -1)
4572 if (!auto_var_p (rhs_ref
.ref
))
4575 auto_diagnostic_group d
;
4576 location_t loc
= gimple_location (stmt
);
4577 if (warning_at (loc
, OPT_Wdangling_pointer_
,
4578 "storing the address of local variable %qD in %qE",
4581 suppress_warning (stmt
, OPT_Wdangling_pointer_
);
4583 location_t loc
= DECL_SOURCE_LOCATION (rhs_ref
.ref
);
4584 inform (loc
, "%qD declared here", rhs_ref
.ref
);
4586 if (DECL_P (lhs_ref
.ref
))
4587 loc
= DECL_SOURCE_LOCATION (lhs_ref
.ref
);
4588 else if (EXPR_HAS_LOCATION (lhs_ref
.ref
))
4589 loc
= EXPR_LOCATION (lhs_ref
.ref
);
4591 if (loc
!= UNKNOWN_LOCATION
)
4592 inform (loc
, "%qE declared here", lhs_ref
.ref
);
4598 FOR_EACH_EDGE (e
, ei
, bb
->preds
)
4600 basic_block pred
= e
->src
;
4601 check_dangling_stores (pred
, stores
, bbs
);
4605 /* Diagnose stores of the addresses of local variables into nonlocal
4606 pointers that are left dangling after the function returns. */
4609 pass_waccess::check_dangling_stores ()
4612 hash_set
<tree
> stores
;
4613 check_dangling_stores (EXIT_BLOCK_PTR_FOR_FN (m_func
), stores
, bbs
);
4616 /* Check for and diagnose uses of dangling pointers to auto objects
4617 whose lifetime has ended. */
4620 pass_waccess::check_dangling_uses ()
4624 FOR_EACH_SSA_NAME (i
, var
, m_func
)
4626 /* For each SSA_NAME pointer VAR find the object it points to.
4627 If the object is a clobbered local variable, check to see
4628 if any of VAR's uses (or those of other pointers derived
4629 from VAR) happens after the clobber. If so, warn. */
4631 gimple
*def_stmt
= SSA_NAME_DEF_STMT (var
);
4632 if (is_gimple_assign (def_stmt
))
4634 tree rhs
= gimple_assign_rhs1 (def_stmt
);
4635 if (TREE_CODE (rhs
) == ADDR_EXPR
)
4637 if (!POINTER_TYPE_P (TREE_TYPE (var
)))
4639 check_dangling_uses (var
, TREE_OPERAND (rhs
, 0));
4643 /* For other expressions, check the base DECL to see
4644 if it's been clobbered, most likely as a result of
4645 inlining a reference to it. */
4646 tree decl
= get_base_address (rhs
);
4648 check_dangling_uses (var
, decl
, false, true);
4651 else if (POINTER_TYPE_P (TREE_TYPE (var
)))
4653 if (gcall
*call
= dyn_cast
<gcall
*>(def_stmt
))
4655 if (tree arg
= gimple_call_return_arg (call
))
4658 if (m_ptr_qry
.get_ref (arg
, call
, &aref
, 0)
4660 check_dangling_uses (var
, aref
.ref
);
4663 else if (gphi
*phi
= dyn_cast
<gphi
*>(def_stmt
))
4665 unsigned nargs
= gimple_phi_num_args (phi
);
4666 for (unsigned i
= 0; i
!= nargs
; ++i
)
4669 tree arg
= gimple_phi_arg_def (phi
, i
);
4670 if (m_ptr_qry
.get_ref (arg
, phi
, &aref
, 0)
4672 check_dangling_uses (var
, aref
.ref
, true);
4679 /* Check CALL arguments for dangling pointers (those that have been
4680 clobbered) and warn if found. */
4683 pass_waccess::check_call_dangling (gcall
*call
)
4685 unsigned nargs
= gimple_call_num_args (call
);
4686 for (unsigned i
= 0; i
!= nargs
; ++i
)
4688 tree arg
= gimple_call_arg (call
, i
);
4689 if (TREE_CODE (arg
) != ADDR_EXPR
)
4692 arg
= TREE_OPERAND (arg
, 0);
4696 gimple
**pclobber
= m_clobbers
.get (arg
);
4700 if (!use_after_inval_p (*pclobber
, call
))
4703 warn_invalid_pointer (NULL_TREE
, call
, *pclobber
, arg
, false);
4707 /* Check function FUN for invalid accesses. */
4710 pass_waccess::execute (function
*fun
)
4712 calculate_dominance_info (CDI_DOMINATORS
);
4713 calculate_dominance_info (CDI_POST_DOMINATORS
);
4715 /* Set or clear EDGE_DFS_BACK bits on back edges. */
4716 mark_dfs_back_edges (fun
);
4718 /* Create a new ranger instance and associate it with FUN. */
4719 m_ptr_qry
.rvals
= enable_ranger (fun
);
4722 /* Check for dangling pointers in the earliest run of the pass.
4723 The latest point -Wdangling-pointer should run is just before
4724 loop unrolling which introduces uses after clobbers. Most cases
4725 can be detected without optimization; cases where the address of
4726 the local variable is passed to and then returned from a user-
4727 defined function before its lifetime ends and the returned pointer
4728 becomes dangling depend on inlining. */
4729 m_check_dangling_p
= m_early_checks_p
;
4731 auto_bitmap
bb_uids_set (&bitmap_default_obstack
);
4732 m_bb_uids_set
= bb_uids_set
;
4734 set_gimple_stmt_max_uid (m_func
, 0);
4737 FOR_EACH_BB_FN (bb
, fun
)
4740 if (m_check_dangling_p
)
4742 check_dangling_uses ();
4743 check_dangling_stores ();
4747 m_ptr_qry
.dump (dump_file
, (dump_flags
& TDF_DETAILS
) != 0);
4749 m_ptr_qry
.flush_cache ();
4751 /* Release the ranger instance and replace it with a global ranger.
4752 Also reset the pointer since calling disable_ranger() deletes it. */
4753 disable_ranger (fun
);
4754 m_ptr_qry
.rvals
= NULL
;
4756 m_clobbers
.empty ();
4757 m_bb_uids_set
= NULL
;
4759 free_dominance_info (CDI_POST_DOMINATORS
);
4760 free_dominance_info (CDI_DOMINATORS
);
4766 /* Return a new instance of the pass. */
4769 make_pass_warn_access (gcc::context
*ctxt
)
4771 return new pass_waccess (ctxt
);