1 /* Pass to detect and issue warnings for violations of the restrict
3 Copyright (C) 2017-2019 Free Software Foundation, Inc.
4 Contributed by Martin Sebor <msebor@redhat.com>.
6 This file is part of GCC.
8 GCC is free software; you can redistribute it and/or modify it under
9 the terms of the GNU General Public License as published by the Free
10 Software Foundation; either version 3, or (at your option) any later
13 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
14 WARRANTY; without even the implied warranty of MERCHANTABILITY or
15 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
18 You should have received a copy of the GNU General Public License
19 along with GCC; see the file COPYING3. If not see
20 <http://www.gnu.org/licenses/>. */
24 #include "coretypes.h"
29 #include "tree-pass.h"
32 #include "gimple-pretty-print.h"
33 #include "gimple-ssa-warn-restrict.h"
34 #include "diagnostic-core.h"
35 #include "fold-const.h"
36 #include "gimple-iterator.h"
41 #include "tree-object-size.h"
48 const pass_data pass_data_wrestrict
= {
53 PROP_cfg
, /* Properties_required. */
54 0, /* properties_provided. */
55 0, /* properties_destroyed. */
56 0, /* properties_start */
57 0, /* properties_finish */
60 /* Pass to detect violations of strict aliasing requirements in calls
61 to built-in string and raw memory functions. */
62 class pass_wrestrict
: public gimple_opt_pass
65 pass_wrestrict (gcc::context
*ctxt
)
66 : gimple_opt_pass (pass_data_wrestrict
, ctxt
)
69 opt_pass
*clone () { return new pass_wrestrict (m_ctxt
); }
71 virtual bool gate (function
*);
72 virtual unsigned int execute (function
*);
76 pass_wrestrict::gate (function
*fun ATTRIBUTE_UNUSED
)
78 return warn_array_bounds
|| warn_restrict
|| warn_stringop_overflow
;
81 /* Class to walk the basic blocks of a function in dominator order. */
82 class wrestrict_dom_walker
: public dom_walker
85 wrestrict_dom_walker () : dom_walker (CDI_DOMINATORS
) {}
87 edge
before_dom_children (basic_block
) FINAL OVERRIDE
;
88 bool handle_gimple_call (gimple_stmt_iterator
*);
91 void check_call (gimple
*);
95 wrestrict_dom_walker::before_dom_children (basic_block bb
)
97 /* Iterate over statements, looking for function calls. */
98 for (gimple_stmt_iterator si
= gsi_start_bb (bb
); !gsi_end_p (si
);
101 gimple
*stmt
= gsi_stmt (si
);
102 if (!is_gimple_call (stmt
))
111 /* Execute the pass for function FUN, walking in dominator order. */
114 pass_wrestrict::execute (function
*fun
)
116 calculate_dominance_info (CDI_DOMINATORS
);
118 wrestrict_dom_walker walker
;
119 walker
.walk (ENTRY_BLOCK_PTR_FOR_FN (fun
));
124 /* Description of a memory reference by a built-in function. This
125 is similar to ao_ref but made especially suitable for -Wrestrict
126 and not for optimization. */
127 struct builtin_memref
129 /* The original pointer argument to the built-in function. */
131 /* The referenced subobject or NULL if not available, and the base
132 object of the memory reference or NULL. */
136 /* The size of the BASE object, PTRDIFF_MAX if indeterminate,
137 and negative until (possibly lazily) initialized. */
140 /* The non-negative offset of the referenced subobject. Used to avoid
141 warnings for (apparently) possibly but not definitively overlapping
142 accesses to member arrays. Negative when unknown/invalid. */
145 /* The offset range relative to the base. */
146 offset_int offrange
[2];
147 /* The size range of the access to this reference. */
148 offset_int sizrange
[2];
150 /* Cached result of get_max_objsize(). */
151 const offset_int maxobjsize
;
153 /* True for "bounded" string functions like strncat, and strncpy
154 and their variants that specify either an exact or upper bound
155 on the size of the accesses they perform. For strncat both
156 the source and destination references are bounded. For strncpy
157 only the destination reference is. */
160 builtin_memref (tree
, tree
);
162 tree
offset_out_of_bounds (int, offset_int
[2]) const;
166 /* Ctor helper to set or extend OFFRANGE based on argument. */
167 void extend_offset_range (tree
);
169 /* Ctor helper to determine BASE and OFFRANGE from argument. */
170 void set_base_and_offset (tree
);
173 /* Description of a memory access by a raw memory or string built-in
174 function involving a pair of builtin_memref's. */
178 /* Destination and source memory reference. */
179 builtin_memref
* const dstref
;
180 builtin_memref
* const srcref
;
181 /* The size range of the access. It's the greater of the accesses
182 to the two references. */
183 HOST_WIDE_INT sizrange
[2];
185 /* The minimum and maximum offset of an overlap of the access
186 (if it does, in fact, overlap), and the size of the overlap. */
187 HOST_WIDE_INT ovloff
[2];
188 HOST_WIDE_INT ovlsiz
[2];
190 /* True to consider valid only accesses to the smallest subobject
191 and false for raw memory functions. */
194 return detect_overlap
!= &builtin_access::generic_overlap
;
197 builtin_access (gimple
*, builtin_memref
&, builtin_memref
&);
199 /* Entry point to determine overlap. */
203 /* Implementation functions used to determine overlap. */
204 bool generic_overlap ();
205 bool strcat_overlap ();
206 bool strcpy_overlap ();
213 offset_int
overlap_size (const offset_int
[2], const offset_int
[2],
217 /* Temporaries used to compute the final result. */
218 offset_int dstoff
[2];
219 offset_int srcoff
[2];
220 offset_int dstsiz
[2];
221 offset_int srcsiz
[2];
223 /* Pointer to a member function to call to determine overlap. */
224 bool (builtin_access::*detect_overlap
) ();
227 /* Initialize a memory reference representation from a pointer EXPR and
228 a size SIZE in bytes. If SIZE is NULL_TREE then the size is assumed
231 builtin_memref::builtin_memref (tree expr
, tree size
)
236 refoff (HOST_WIDE_INT_MIN
),
239 maxobjsize (tree_to_shwi (max_object_size ())),
242 /* Unfortunately, wide_int default ctor is a no-op so array members
243 of the type must be set individually. */
244 offrange
[0] = offrange
[1] = 0;
245 sizrange
[0] = sizrange
[1] = 0;
250 /* Find the BASE object or pointer referenced by EXPR and set
251 the offset range OFFRANGE in the process. */
252 set_base_and_offset (expr
);
257 /* Determine the size range, allowing for the result to be [0, 0]
258 for SIZE in the anti-range ~[0, N] where N >= PTRDIFF_MAX. */
259 get_size_range (size
, range
, true);
260 sizrange
[0] = wi::to_offset (range
[0]);
261 sizrange
[1] = wi::to_offset (range
[1]);
262 /* get_size_range returns SIZE_MAX for the maximum size.
263 Constrain it to the real maximum of PTRDIFF_MAX. */
264 if (sizrange
[0] <= maxobjsize
&& sizrange
[1] > maxobjsize
)
265 sizrange
[1] = maxobjsize
;
268 sizrange
[1] = maxobjsize
;
273 /* If the offset could be in the range of the referenced object
274 constrain its bounds so neither exceeds those of the object. */
275 if (offrange
[0] < 0 && offrange
[1] > 0)
278 offset_int maxoff
= maxobjsize
;
279 tree basetype
= TREE_TYPE (base
);
280 if (TREE_CODE (basetype
) == ARRAY_TYPE
)
282 if (ref
&& array_at_struct_end_p (ref
))
283 ; /* Use the maximum possible offset for last member arrays. */
284 else if (tree basesize
= TYPE_SIZE_UNIT (basetype
))
285 if (TREE_CODE (basesize
) == INTEGER_CST
)
286 /* Size could be non-constant for a variable-length type such
287 as a struct with a VLA member (a GCC extension). */
288 maxoff
= wi::to_offset (basesize
);
291 if (offrange
[0] >= 0)
294 offrange
[1] = offrange
[0] <= maxoff
? maxoff
: maxobjsize
;
295 else if (offrange
[0] <= maxoff
&& offrange
[1] > maxoff
)
296 offrange
[1] = maxoff
;
300 /* Ctor helper to set or extend OFFRANGE based on the OFFSET argument.
301 Pointer offsets are represented as unsigned sizetype but must be
302 treated as signed. */
305 builtin_memref::extend_offset_range (tree offset
)
307 if (TREE_CODE (offset
) == INTEGER_CST
)
309 offset_int off
= int_cst_value (offset
);
318 if (TREE_CODE (offset
) == SSA_NAME
)
320 /* A pointer offset is represented as sizetype but treated
323 value_range_kind rng
= get_range_info (offset
, &min
, &max
);
324 if (rng
== VR_ANTI_RANGE
&& wi::lts_p (max
, min
))
326 /* Convert an anti-range whose upper bound is less than
327 its lower bound to a signed range. */
328 offrange
[0] += offset_int::from (max
+ 1, SIGNED
);
329 offrange
[1] += offset_int::from (min
- 1, SIGNED
);
334 && (DECL_P (base
) || wi::lts_p (min
, max
)))
336 /* Preserve the bounds of the range for an offset into
337 a known object (it may be adjusted later relative to
338 a constant offset from its beginning). Otherwise use
339 the bounds only when they are ascending when treated
341 offrange
[0] += offset_int::from (min
, SIGNED
);
342 offrange
[1] += offset_int::from (max
, SIGNED
);
346 /* Handle an anti-range the same as no range at all. */
347 gimple
*stmt
= SSA_NAME_DEF_STMT (offset
);
349 if (is_gimple_assign (stmt
)
350 && (type
= TREE_TYPE (gimple_assign_rhs1 (stmt
)))
351 && INTEGRAL_TYPE_P (type
))
353 tree_code code
= gimple_assign_rhs_code (stmt
);
354 if (code
== NOP_EXPR
)
356 /* Use the bounds of the type of the NOP_EXPR operand
357 even if it's signed. The result doesn't trigger
358 warnings but makes their output more readable. */
359 offrange
[0] += wi::to_offset (TYPE_MIN_VALUE (type
));
360 offrange
[1] += wi::to_offset (TYPE_MAX_VALUE (type
));
366 const offset_int maxoff
= tree_to_shwi (max_object_size ()) >> 1;
367 const offset_int minoff
= -maxoff
- 1;
369 offrange
[0] += minoff
;
370 offrange
[1] += maxoff
;
373 /* Determines the base object or pointer of the reference EXPR
374 and the offset range from the beginning of the base. */
377 builtin_memref::set_base_and_offset (tree expr
)
379 tree offset
= NULL_TREE
;
381 if (TREE_CODE (expr
) == SSA_NAME
)
383 /* Try to tease the offset out of the pointer. */
384 gimple
*stmt
= SSA_NAME_DEF_STMT (expr
);
386 && gimple_assign_single_p (stmt
)
387 && gimple_assign_rhs_code (stmt
) == ADDR_EXPR
)
388 expr
= gimple_assign_rhs1 (stmt
);
389 else if (is_gimple_assign (stmt
))
391 tree_code code
= gimple_assign_rhs_code (stmt
);
392 if (code
== NOP_EXPR
)
394 tree rhs
= gimple_assign_rhs1 (stmt
);
395 if (POINTER_TYPE_P (TREE_TYPE (rhs
)))
396 expr
= gimple_assign_rhs1 (stmt
);
403 else if (code
== POINTER_PLUS_EXPR
)
405 expr
= gimple_assign_rhs1 (stmt
);
406 offset
= gimple_assign_rhs2 (stmt
);
416 /* FIXME: Handle PHI nodes in case like:
417 _12 = &MEM[(void *)&a + 2B] + _10;
419 <bb> [local count: 1073741824]:
420 # prephitmp_13 = PHI <_12, &MEM[(void *)&a + 2B]>
421 memcpy (prephitmp_13, p_7(D), 6); */
427 if (TREE_CODE (expr
) == ADDR_EXPR
)
428 expr
= TREE_OPERAND (expr
, 0);
430 /* Stash the reference for offset validation. */
433 poly_int64 bitsize
, bitpos
;
436 int sign
, reverse
, vol
;
438 /* Determine the base object or pointer of the reference and
439 the constant bit offset from the beginning of the base.
440 If the offset has a non-constant component, it will be in
441 VAR_OFF. MODE, SIGN, REVERSE, and VOL are write only and
443 base
= get_inner_reference (expr
, &bitsize
, &bitpos
, &var_off
,
444 &mode
, &sign
, &reverse
, &vol
);
446 /* get_inner_reference is not expected to return null. */
447 gcc_assert (base
!= NULL
);
450 extend_offset_range (offset
);
452 poly_int64 bytepos
= exact_div (bitpos
, BITS_PER_UNIT
);
454 /* Convert the poly_int64 offset to offset_int. The offset
455 should be constant but be prepared for it not to be just in
458 if (bytepos
.is_constant (&cstoff
))
460 offrange
[0] += cstoff
;
461 offrange
[1] += cstoff
;
463 /* Besides the reference saved above, also stash the offset
465 if (TREE_CODE (expr
) == COMPONENT_REF
)
469 offrange
[1] += maxobjsize
;
473 if (TREE_CODE (var_off
) == INTEGER_CST
)
475 cstoff
= wi::to_offset (var_off
);
476 offrange
[0] += cstoff
;
477 offrange
[1] += cstoff
;
480 offrange
[1] += maxobjsize
;
483 if (TREE_CODE (base
) == MEM_REF
)
485 tree memrefoff
= TREE_OPERAND (base
, 1);
486 extend_offset_range (memrefoff
);
487 base
= TREE_OPERAND (base
, 0);
490 if (TREE_CODE (base
) == SSA_NAME
)
491 set_base_and_offset (base
);
494 /* Return error_mark_node if the signed offset exceeds the bounds
495 of the address space (PTRDIFF_MAX). Otherwise, return either
496 BASE or REF when the offset exceeds the bounds of the BASE or
497 REF object, and set OOBOFF to the past-the-end offset formed
498 by the reference, including its size. When STRICT is non-zero
499 use REF size, when available, otherwise use BASE size. When
500 STRICT is greater than 1, use the size of the last array member
501 as the bound, otherwise treat such a member as a flexible array
502 member. Return NULL when the offset is in bounds. */
505 builtin_memref::offset_out_of_bounds (int strict
, offset_int ooboff
[2]) const
510 /* A temporary, possibly adjusted, copy of the offset range. */
511 offset_int offrng
[2] = { offrange
[0], offrange
[1] };
513 if (DECL_P (base
) && TREE_CODE (TREE_TYPE (base
)) == ARRAY_TYPE
)
515 /* Check for offset in an anti-range with a negative lower bound.
516 For such a range, consider only the non-negative subrange. */
517 if (offrng
[1] < offrng
[0] && offrng
[1] < 0)
518 offrng
[1] = maxobjsize
;
521 /* Conservative offset of the last byte of the referenced object. */
524 /* The bounds need not be ordered. Set HIB to use as the index
525 of the larger of the bounds and LOB as the opposite. */
526 bool hib
= wi::les_p (offrng
[0], offrng
[1]);
531 endoff
= offrng
[lob
] + sizrange
[0];
533 /* For a reference through a pointer to an object of unknown size
534 all initial offsets are considered valid, positive as well as
535 negative, since the pointer itself can point past the beginning
536 of the object. However, the sum of the lower bound of the offset
537 and that of the size must be less than or equal than PTRDIFF_MAX. */
538 if (endoff
> maxobjsize
)
539 return error_mark_node
;
544 /* A reference to an object of known size must be within the bounds
545 of the base object. */
546 if (offrng
[hib
] < 0 || offrng
[lob
] > basesize
)
549 /* The extent of the reference must also be within the bounds of
550 the base object (if known) or the maximum object size otherwise. */
551 endoff
= wi::smax (offrng
[lob
], 0) + sizrange
[0];
552 if (endoff
> maxobjsize
)
553 return error_mark_node
;
555 offset_int size
= basesize
;
562 && TREE_CODE (ref
) == COMPONENT_REF
564 || !array_at_struct_end_p (ref
)))
566 /* If the reference is to a member subobject, the offset must
567 be within the bounds of the subobject. */
568 tree field
= TREE_OPERAND (ref
, 1);
569 tree type
= TREE_TYPE (field
);
570 if (tree sz
= TYPE_SIZE_UNIT (type
))
571 if (TREE_CODE (sz
) == INTEGER_CST
)
573 size
= refoff
+ wi::to_offset (sz
);
581 /* Set the out-of-bounds offset range to be one greater than
582 that delimited by the reference including its size. */
583 ooboff
[lob
] = size
+ 1;
585 if (endoff
> ooboff
[lob
])
586 ooboff
[hib
] = endoff
;
588 ooboff
[hib
] = wi::smax (offrng
[lob
], 0) + sizrange
[1];
593 /* Create an association between the memory references DST and SRC
594 for access by a call EXPR to a memory or string built-in funtion. */
596 builtin_access::builtin_access (gimple
*call
, builtin_memref
&dst
,
598 : dstref (&dst
), srcref (&src
), sizrange (), ovloff (), ovlsiz (),
599 dstoff (), srcoff (), dstsiz (), srcsiz ()
601 /* Zero out since the offset_int ctors invoked above are no-op. */
602 dstoff
[0] = dstoff
[1] = 0;
603 srcoff
[0] = srcoff
[1] = 0;
604 dstsiz
[0] = dstsiz
[1] = 0;
605 srcsiz
[0] = srcsiz
[1] = 0;
607 /* Object Size Type to use to determine the size of the destination
608 and source objects. Overridden below for raw memory functions. */
611 /* True when the size of one reference depends on the offset of
612 itself or the other. */
613 bool depends_p
= true;
615 /* True when the size of the destination reference DSTREF has been
616 determined from SRCREF and so needs to be adjusted by the latter's
617 offset. Only meaningful for bounded string functions like strncpy. */
618 bool dstadjust_p
= false;
620 /* The size argument number (depends on the built-in). */
621 unsigned sizeargno
= 2;
623 tree func
= gimple_call_fndecl (call
);
624 switch (DECL_FUNCTION_CODE (func
))
626 case BUILT_IN_MEMCPY
:
627 case BUILT_IN_MEMCPY_CHK
:
628 case BUILT_IN_MEMPCPY
:
629 case BUILT_IN_MEMPCPY_CHK
:
632 detect_overlap
= &builtin_access::generic_overlap
;
635 case BUILT_IN_MEMMOVE
:
636 case BUILT_IN_MEMMOVE_CHK
:
637 /* For memmove there is never any overlap to check for. */
640 detect_overlap
= &builtin_access::no_overlap
;
643 case BUILT_IN_MEMSET
:
644 case BUILT_IN_MEMSET_CHK
:
645 /* For memset there is never any overlap to check for. */
648 detect_overlap
= &builtin_access::no_overlap
;
651 case BUILT_IN_STPNCPY
:
652 case BUILT_IN_STPNCPY_CHK
:
653 case BUILT_IN_STRNCPY
:
654 case BUILT_IN_STRNCPY_CHK
:
655 dstref
->strbounded_p
= true;
656 detect_overlap
= &builtin_access::strcpy_overlap
;
659 case BUILT_IN_STPCPY
:
660 case BUILT_IN_STPCPY_CHK
:
661 case BUILT_IN_STRCPY
:
662 case BUILT_IN_STRCPY_CHK
:
663 detect_overlap
= &builtin_access::strcpy_overlap
;
666 case BUILT_IN_STRCAT
:
667 case BUILT_IN_STRCAT_CHK
:
668 detect_overlap
= &builtin_access::strcat_overlap
;
671 case BUILT_IN_STRNCAT
:
672 case BUILT_IN_STRNCAT_CHK
:
673 dstref
->strbounded_p
= true;
674 srcref
->strbounded_p
= true;
675 detect_overlap
= &builtin_access::strcat_overlap
;
679 /* Handle other string functions here whose access may need
680 to be validated for in-bounds offsets and non-overlapping
685 const offset_int maxobjsize
= dst
.maxobjsize
;
687 /* Try to determine the size of the base object. compute_objsize
688 expects a pointer so create one if BASE is a non-pointer object. */
690 if (dst
.basesize
< 0)
693 if (!POINTER_TYPE_P (TREE_TYPE (addr
)))
694 addr
= build1 (ADDR_EXPR
, (TREE_TYPE (addr
)), addr
);
696 if (tree dstsize
= compute_objsize (addr
, ostype
))
697 dst
.basesize
= wi::to_offset (dstsize
);
698 else if (POINTER_TYPE_P (TREE_TYPE (addr
)))
699 dst
.basesize
= HOST_WIDE_INT_MIN
;
701 dst
.basesize
= maxobjsize
;
704 if (src
.base
&& src
.basesize
< 0)
707 if (!POINTER_TYPE_P (TREE_TYPE (addr
)))
708 addr
= build1 (ADDR_EXPR
, (TREE_TYPE (addr
)), addr
);
710 if (tree srcsize
= compute_objsize (addr
, ostype
))
711 src
.basesize
= wi::to_offset (srcsize
);
712 else if (POINTER_TYPE_P (TREE_TYPE (addr
)))
713 src
.basesize
= HOST_WIDE_INT_MIN
;
715 src
.basesize
= maxobjsize
;
718 /* If there is no dependency between the references or the base
719 objects of the two references aren't the same there's nothing
721 if (depends_p
&& dstref
->base
!= srcref
->base
)
724 /* ...otherwise, make adjustments for references to the same object
725 by string built-in functions to reflect the constraints imposed
728 /* For bounded string functions determine the range of the bound
729 on the access. For others, the range stays unbounded. */
730 offset_int bounds
[2] = { maxobjsize
, maxobjsize
};
731 if (dstref
->strbounded_p
)
733 tree size
= gimple_call_arg (call
, sizeargno
);
735 if (get_size_range (size
, range
, true))
737 bounds
[0] = wi::to_offset (range
[0]);
738 bounds
[1] = wi::to_offset (range
[1]);
741 /* If both references' size ranges are indeterminate use the last
742 (size) argument from the function call as a substitute. This
743 may only be necessary for strncpy (but not for memcpy where
744 the size range would have been already determined this way). */
745 if (dstref
->sizrange
[0] == 0 && dstref
->sizrange
[1] == maxobjsize
746 && srcref
->sizrange
[0] == 0 && srcref
->sizrange
[1] == maxobjsize
)
748 dstref
->sizrange
[0] = bounds
[0];
749 dstref
->sizrange
[1] = bounds
[1];
753 /* The size range of one reference involving the same base object
754 can be determined from the size range of the other reference.
755 This makes it possible to compute accurate offsets for warnings
756 involving functions like strcpy where the length of just one of
757 the two arguments is known (determined by tree-ssa-strlen). */
758 if (dstref
->sizrange
[0] == 0 && dstref
->sizrange
[1] == maxobjsize
)
760 /* When the destination size is unknown set it to the size of
762 dstref
->sizrange
[0] = srcref
->sizrange
[0];
763 dstref
->sizrange
[1] = srcref
->sizrange
[1];
765 else if (srcref
->sizrange
[0] == 0 && srcref
->sizrange
[1] == maxobjsize
)
767 /* When the source size is unknown set it to the size of
769 srcref
->sizrange
[0] = dstref
->sizrange
[0];
770 srcref
->sizrange
[1] = dstref
->sizrange
[1];
774 if (dstref
->strbounded_p
)
776 /* Read access by strncpy is bounded. */
777 if (bounds
[0] < srcref
->sizrange
[0])
778 srcref
->sizrange
[0] = bounds
[0];
779 if (bounds
[1] < srcref
->sizrange
[1])
780 srcref
->sizrange
[1] = bounds
[1];
783 /* For string functions, adjust the size range of the source
784 reference by the inverse boundaries of the offset (because
785 the higher the offset into the string the shorter its
787 if (srcref
->offrange
[1] >= 0
788 && srcref
->offrange
[1] < srcref
->sizrange
[0])
789 srcref
->sizrange
[0] -= srcref
->offrange
[1];
791 srcref
->sizrange
[0] = 0;
793 if (srcref
->offrange
[0] > 0)
795 if (srcref
->offrange
[0] < srcref
->sizrange
[1])
796 srcref
->sizrange
[1] -= srcref
->offrange
[0];
798 srcref
->sizrange
[1] = 0;
805 if (detect_overlap
== &builtin_access::generic_overlap
)
807 if (dstref
->strbounded_p
)
809 dstref
->sizrange
[0] = bounds
[0];
810 dstref
->sizrange
[1] = bounds
[1];
812 if (dstref
->sizrange
[0] < srcref
->sizrange
[0])
813 srcref
->sizrange
[0] = dstref
->sizrange
[0];
815 if (dstref
->sizrange
[1] < srcref
->sizrange
[1])
816 srcref
->sizrange
[1] = dstref
->sizrange
[1];
819 else if (detect_overlap
== &builtin_access::strcpy_overlap
)
821 if (!dstref
->strbounded_p
)
823 /* For strcpy, adjust the destination size range to match that
824 of the source computed above. */
825 if (depends_p
&& dstadjust_p
)
827 dstref
->sizrange
[0] = srcref
->sizrange
[0];
828 dstref
->sizrange
[1] = srcref
->sizrange
[1];
833 if (dstref
->strbounded_p
)
835 /* For strncpy, adjust the destination size range to match that
836 of the source computed above. */
837 dstref
->sizrange
[0] = bounds
[0];
838 dstref
->sizrange
[1] = bounds
[1];
840 if (bounds
[0] < srcref
->sizrange
[0])
841 srcref
->sizrange
[0] = bounds
[0];
843 if (bounds
[1] < srcref
->sizrange
[1])
844 srcref
->sizrange
[1] = bounds
[1];
849 builtin_access::overlap_size (const offset_int a
[2], const offset_int b
[2],
852 const offset_int
*p
= a
;
853 const offset_int
*q
= b
;
855 /* Point P at the bigger of the two ranges and Q at the smaller. */
856 if (wi::lts_p (a
[1] - a
[0], b
[1] - b
[0]))
868 return wi::smin (p
[1], q
[1]) - q
[0];
878 /* Return true if the bounded mempry (memcpy amd similar) or string function
879 access (strncpy and similar) ACS overlaps. */
882 builtin_access::generic_overlap ()
884 builtin_access
&acs
= *this;
885 const builtin_memref
*dstref
= acs
.dstref
;
886 const builtin_memref
*srcref
= acs
.srcref
;
888 gcc_assert (dstref
->base
== srcref
->base
);
890 const offset_int maxobjsize
= acs
.dstref
->maxobjsize
;
892 offset_int maxsize
= dstref
->basesize
< 0 ? maxobjsize
: dstref
->basesize
;
893 gcc_assert (maxsize
<= maxobjsize
);
895 /* Adjust the larger bounds of the offsets (which may be the first
896 element if the lower bound is larger than the upper bound) to
897 make them valid for the smallest access (if possible) but no smaller
898 than the smaller bounds. */
899 gcc_assert (wi::les_p (acs
.dstoff
[0], acs
.dstoff
[1]));
901 if (maxsize
< acs
.dstoff
[1] + acs
.dstsiz
[0])
902 acs
.dstoff
[1] = maxsize
- acs
.dstsiz
[0];
903 if (acs
.dstoff
[1] < acs
.dstoff
[0])
904 acs
.dstoff
[1] = acs
.dstoff
[0];
906 gcc_assert (wi::les_p (acs
.srcoff
[0], acs
.srcoff
[1]));
908 if (maxsize
< acs
.srcoff
[1] + acs
.srcsiz
[0])
909 acs
.srcoff
[1] = maxsize
- acs
.srcsiz
[0];
910 if (acs
.srcoff
[1] < acs
.srcoff
[0])
911 acs
.srcoff
[1] = acs
.srcoff
[0];
913 /* Determine the minimum and maximum space for the access given
916 space
[0] = wi::abs (acs
.dstoff
[0] - acs
.srcoff
[0]);
919 offset_int d
= wi::abs (acs
.dstoff
[0] - acs
.srcoff
[1]);
920 if (acs
.srcsiz
[0] > 0)
929 space
[1] = acs
.dstsiz
[1];
931 d
= wi::abs (acs
.dstoff
[1] - acs
.srcoff
[0]);
938 /* Treat raw memory functions both of whose references are bounded
939 as special and permit uncertain overlaps to go undetected. For
940 all kinds of constant offset and constant size accesses, if
941 overlap isn't certain it is not possible. */
942 bool overlap_possible
= space
[0] < acs
.dstsiz
[1];
943 if (!overlap_possible
)
946 bool overlap_certain
= space
[1] < acs
.dstsiz
[0];
948 /* True when the size of one reference depends on the offset of
950 bool depends_p
= detect_overlap
!= &builtin_access::generic_overlap
;
952 if (!overlap_certain
)
954 if (!dstref
->strbounded_p
&& !depends_p
)
955 /* Memcpy only considers certain overlap. */
958 /* There's no way to distinguish an access to the same member
959 of a structure from one to two distinct members of the same
960 structure. Give up to avoid excessive false positives. */
961 tree basetype
= TREE_TYPE (dstref
->base
);
963 if (POINTER_TYPE_P (basetype
))
964 basetype
= TREE_TYPE (basetype
);
966 while (TREE_CODE (basetype
) == ARRAY_TYPE
)
967 basetype
= TREE_TYPE (basetype
);
969 if (RECORD_OR_UNION_TYPE_P (basetype
))
973 /* True for stpcpy and strcpy. */
974 bool stxcpy_p
= (!dstref
->strbounded_p
975 && detect_overlap
== &builtin_access::strcpy_overlap
);
977 if (dstref
->refoff
>= 0
978 && srcref
->refoff
>= 0
979 && dstref
->refoff
!= srcref
->refoff
980 && (stxcpy_p
|| dstref
->strbounded_p
|| srcref
->strbounded_p
))
983 offset_int siz
[2] = { maxobjsize
+ 1, 0 };
985 ovloff
[0] = HOST_WIDE_INT_MAX
;
986 ovloff
[1] = HOST_WIDE_INT_MIN
;
988 /* Adjustment to the lower bound of the offset of the overlap to
989 account for a subset of unbounded string calls where the size
990 of the destination string depends on the length of the source
991 which in turn depends on the offset into it. */
996 sub1
= acs
.dstoff
[0] <= acs
.srcoff
[0];
998 /* Iterate over the extreme locations (on the horizontal axis formed
999 by their offsets) and sizes of two regions and find their smallest
1000 and largest overlap and the corresponding offsets. */
1001 for (unsigned i
= 0; i
!= 2; ++i
)
1003 const offset_int a
[2] = {
1004 acs
.dstoff
[i
], acs
.dstoff
[i
] + acs
.dstsiz
[!i
]
1007 const offset_int b
[2] = {
1008 acs
.srcoff
[i
], acs
.srcoff
[i
] + acs
.srcsiz
[!i
]
1012 offset_int sz
= overlap_size (a
, b
, &off
);
1021 if (wi::lts_p (off
, ovloff
[0]))
1022 ovloff
[0] = off
.to_shwi ();
1023 if (wi::lts_p (ovloff
[1], off
))
1024 ovloff
[1] = off
.to_shwi ();
1032 /* Iterate over the extreme locations (on the horizontal axis
1033 formed by their offsets) and sizes of two regions and find
1034 their smallest and largest overlap and the corresponding
1037 for (unsigned io
= 0; io
!= 2; ++io
)
1038 for (unsigned is
= 0; is
!= 2; ++is
)
1040 const offset_int a
[2] = {
1041 acs
.dstoff
[io
], acs
.dstoff
[io
] + acs
.dstsiz
[is
]
1044 for (unsigned jo
= 0; jo
!= 2; ++jo
)
1045 for (unsigned js
= 0; js
!= 2; ++js
)
1049 /* For st{p,r}ncpy the size of the source sequence
1050 depends on the offset into it. */
1056 const offset_int b
[2] = {
1057 acs
.srcoff
[jo
], acs
.srcoff
[jo
] + acs
.srcsiz
[js
]
1061 offset_int sz
= overlap_size (a
, b
, &off
);
1070 if (wi::lts_p (off
, ovloff
[0]))
1071 ovloff
[0] = off
.to_shwi ();
1072 if (wi::lts_p (ovloff
[1], off
))
1073 ovloff
[1] = off
.to_shwi ();
1079 ovlsiz
[0] = siz
[0].to_shwi ();
1080 ovlsiz
[1] = siz
[1].to_shwi ();
1082 if (ovlsiz
[0] == 0 && ovlsiz
[1] > 1)
1083 ovloff
[0] = ovloff
[1] + ovlsiz
[1] - 1 - sub1
;
1088 /* Return true if the strcat-like access overlaps. */
1091 builtin_access::strcat_overlap ()
1093 builtin_access
&acs
= *this;
1094 const builtin_memref
*dstref
= acs
.dstref
;
1095 const builtin_memref
*srcref
= acs
.srcref
;
1097 gcc_assert (dstref
->base
== srcref
->base
);
1099 const offset_int maxobjsize
= acs
.dstref
->maxobjsize
;
1101 gcc_assert (dstref
->base
&& dstref
->base
== srcref
->base
);
1103 /* Adjust for strcat-like accesses. */
1105 /* As a special case for strcat, set the DSTREF offsets to the length
1106 of the source string since the function starts writing at the first
1107 nul, and set the size to 1 for the length of the nul. */
1108 acs
.dstoff
[0] += acs
.dstsiz
[0];
1109 acs
.dstoff
[1] += acs
.dstsiz
[1];
1111 bool strfunc_unknown_args
= acs
.dstsiz
[0] == 0 && acs
.dstsiz
[1] != 0;
1113 /* The lower bound is zero when the size is unknown because then
1114 overlap is not certain. */
1115 acs
.dstsiz
[0] = strfunc_unknown_args
? 0 : 1;
1118 offset_int maxsize
= dstref
->basesize
< 0 ? maxobjsize
: dstref
->basesize
;
1119 gcc_assert (maxsize
<= maxobjsize
);
1121 /* For references to the same base object, determine if there's a pair
1122 of valid offsets into the two references such that access between
1123 them doesn't overlap. Adjust both upper bounds to be valid for
1124 the smaller size (i.e., at most MAXSIZE - SIZE). */
1126 if (maxsize
< acs
.dstoff
[1] + acs
.dstsiz
[0])
1127 acs
.dstoff
[1] = maxsize
- acs
.dstsiz
[0];
1129 if (maxsize
< acs
.srcoff
[1] + acs
.srcsiz
[0])
1130 acs
.srcoff
[1] = maxsize
- acs
.srcsiz
[0];
1132 /* Check to see if there's enough space for both accesses without
1133 overlap. Determine the optimistic (maximum) amount of available
1136 if (acs
.dstoff
[0] <= acs
.srcoff
[0])
1138 if (acs
.dstoff
[1] < acs
.srcoff
[1])
1139 space
= acs
.srcoff
[1] + acs
.srcsiz
[0] - acs
.dstoff
[0];
1141 space
= acs
.dstoff
[1] + acs
.dstsiz
[0] - acs
.srcoff
[0];
1144 space
= acs
.dstoff
[1] + acs
.dstsiz
[0] - acs
.srcoff
[0];
1146 /* Overlap is certain if the distance between the farthest offsets
1147 of the opposite accesses is less than the sum of the lower bounds
1148 of the sizes of the two accesses. */
1149 bool overlap_certain
= space
< acs
.dstsiz
[0] + acs
.srcsiz
[0];
1151 /* For a constant-offset, constant size access, consider the largest
1152 distance between the offset bounds and the lower bound of the access
1153 size. If the overlap isn't certain return success. */
1154 if (!overlap_certain
1155 && acs
.dstoff
[0] == acs
.dstoff
[1]
1156 && acs
.srcoff
[0] == acs
.srcoff
[1]
1157 && acs
.dstsiz
[0] == acs
.dstsiz
[1]
1158 && acs
.srcsiz
[0] == acs
.srcsiz
[1])
1161 /* Overlap is not certain but may be possible. */
1163 offset_int access_min
= acs
.dstsiz
[0] + acs
.srcsiz
[0];
1165 /* Determine the conservative (minimum) amount of space. */
1166 space
= wi::abs (acs
.dstoff
[0] - acs
.srcoff
[0]);
1167 offset_int d
= wi::abs (acs
.dstoff
[0] - acs
.srcoff
[1]);
1170 d
= wi::abs (acs
.dstoff
[1] - acs
.srcoff
[0]);
1174 /* For a strict test (used for strcpy and similar with unknown or
1175 variable bounds or sizes), consider the smallest distance between
1176 the offset bounds and either the upper bound of the access size
1177 if known, or the lower bound otherwise. */
1178 if (access_min
<= space
&& (access_min
!= 0 || !strfunc_unknown_args
))
1181 /* When strcat overlap is certain it is always a single byte:
1182 the terminating NUL, regardless of offsets and sizes. When
1183 overlap is only possible its range is [0, 1]. */
1184 acs
.ovlsiz
[0] = dstref
->sizrange
[0] == dstref
->sizrange
[1] ? 1 : 0;
1187 offset_int endoff
= dstref
->offrange
[0] + dstref
->sizrange
[0];
1188 if (endoff
<= srcref
->offrange
[0])
1189 acs
.ovloff
[0] = wi::smin (maxobjsize
, srcref
->offrange
[0]).to_shwi ();
1191 acs
.ovloff
[0] = wi::smin (maxobjsize
, endoff
).to_shwi ();
1193 acs
.sizrange
[0] = wi::smax (wi::abs (endoff
- srcref
->offrange
[0]) + 1,
1194 srcref
->sizrange
[0]).to_shwi ();
1195 if (dstref
->offrange
[0] == dstref
->offrange
[1])
1197 if (srcref
->offrange
[0] == srcref
->offrange
[1])
1198 acs
.ovloff
[1] = acs
.ovloff
[0];
1201 = wi::smin (maxobjsize
,
1202 srcref
->offrange
[1] + srcref
->sizrange
[1]).to_shwi ();
1206 = wi::smin (maxobjsize
,
1207 dstref
->offrange
[1] + dstref
->sizrange
[1]).to_shwi ();
1209 if (acs
.sizrange
[0] == 0)
1210 acs
.sizrange
[0] = 1;
1211 acs
.sizrange
[1] = wi::smax (acs
.dstsiz
[1], srcref
->sizrange
[1]).to_shwi ();
1215 /* Return true if the strcpy-like access overlaps. */
1218 builtin_access::strcpy_overlap ()
1220 return generic_overlap ();
1224 /* Return true if DSTREF and SRCREF describe accesses that either overlap
1225 one another or that, in order not to overlap, would imply that the size
1226 of the referenced object(s) exceeds the maximum size of an object. Set
1227 Otherwise, if DSTREF and SRCREF do not definitely overlap (even though
1228 they may overlap in a way that's not apparent from the available data),
1232 builtin_access::overlap ()
1234 builtin_access
&acs
= *this;
1236 const offset_int maxobjsize
= dstref
->maxobjsize
;
1238 acs
.sizrange
[0] = wi::smax (dstref
->sizrange
[0],
1239 srcref
->sizrange
[0]).to_shwi ();
1240 acs
.sizrange
[1] = wi::smax (dstref
->sizrange
[1],
1241 srcref
->sizrange
[1]).to_shwi ();
1243 /* Check to see if the two references refer to regions that are
1244 too large not to overlap in the address space (whose maximum
1245 size is PTRDIFF_MAX). */
1246 offset_int size
= dstref
->sizrange
[0] + srcref
->sizrange
[0];
1247 if (maxobjsize
< size
)
1249 acs
.ovloff
[0] = (maxobjsize
- dstref
->sizrange
[0]).to_shwi ();
1250 acs
.ovlsiz
[0] = (size
- maxobjsize
).to_shwi ();
1254 /* If both base objects aren't known return the maximum possible
1255 offset that would make them not overlap. */
1256 if (!dstref
->base
|| !srcref
->base
)
1259 /* Set the access offsets. */
1260 acs
.dstoff
[0] = dstref
->offrange
[0];
1261 acs
.dstoff
[1] = dstref
->offrange
[1];
1263 /* If the base object is an array adjust the bounds of the offset
1264 to be non-negative and within the bounds of the array if possible. */
1266 && TREE_CODE (TREE_TYPE (dstref
->base
)) == ARRAY_TYPE
)
1268 if (acs
.dstoff
[0] < 0 && acs
.dstoff
[1] >= 0)
1271 if (acs
.dstoff
[1] < acs
.dstoff
[0])
1273 if (tree size
= TYPE_SIZE_UNIT (TREE_TYPE (dstref
->base
)))
1274 acs
.dstoff
[1] = wi::umin (acs
.dstoff
[1], wi::to_offset (size
));
1276 acs
.dstoff
[1] = wi::umin (acs
.dstoff
[1], maxobjsize
);
1280 acs
.srcoff
[0] = srcref
->offrange
[0];
1281 acs
.srcoff
[1] = srcref
->offrange
[1];
1284 && TREE_CODE (TREE_TYPE (srcref
->base
)) == ARRAY_TYPE
)
1286 if (acs
.srcoff
[0] < 0 && acs
.srcoff
[1] >= 0)
1289 if (tree size
= TYPE_SIZE_UNIT (TREE_TYPE (srcref
->base
)))
1290 acs
.srcoff
[1] = wi::umin (acs
.srcoff
[1], wi::to_offset (size
));
1291 else if (acs
.srcoff
[1] < acs
.srcoff
[0])
1292 acs
.srcoff
[1] = wi::umin (acs
.srcoff
[1], maxobjsize
);
1295 /* When the upper bound of the offset is less than the lower bound
1296 the former is the result of a negative offset being represented
1297 as a large positive value or vice versa. The resulting range is
1298 a union of two subranges: [MIN, UB] and [LB, MAX]. Since such
1299 a union is not representable using the current data structure
1300 replace it with the full range of offsets. */
1301 if (acs
.dstoff
[1] < acs
.dstoff
[0])
1303 acs
.dstoff
[0] = -maxobjsize
- 1;
1304 acs
.dstoff
[1] = maxobjsize
;
1307 /* Validate the offset and size of each reference on its own first.
1308 This is independent of whether or not the base objects are the
1309 same. Normally, this would have already been detected and
1310 diagnosed by -Warray-bounds, unless it has been disabled. */
1311 offset_int maxoff
= acs
.dstoff
[0] + dstref
->sizrange
[0];
1312 if (maxobjsize
< maxoff
)
1314 acs
.ovlsiz
[0] = (maxoff
- maxobjsize
).to_shwi ();
1315 acs
.ovloff
[0] = acs
.dstoff
[0].to_shwi () - acs
.ovlsiz
[0];
1319 /* Repeat the same as above but for the source offsets. */
1320 if (acs
.srcoff
[1] < acs
.srcoff
[0])
1322 acs
.srcoff
[0] = -maxobjsize
- 1;
1323 acs
.srcoff
[1] = maxobjsize
;
1326 maxoff
= acs
.srcoff
[0] + srcref
->sizrange
[0];
1327 if (maxobjsize
< maxoff
)
1329 acs
.ovlsiz
[0] = (maxoff
- maxobjsize
).to_shwi ();
1330 acs
.ovlsiz
[1] = (acs
.srcoff
[0] + srcref
->sizrange
[1]
1331 - maxobjsize
).to_shwi ();
1332 acs
.ovloff
[0] = acs
.srcoff
[0].to_shwi () - acs
.ovlsiz
[0];
1336 if (dstref
->base
!= srcref
->base
)
1339 acs
.dstsiz
[0] = dstref
->sizrange
[0];
1340 acs
.dstsiz
[1] = dstref
->sizrange
[1];
1342 acs
.srcsiz
[0] = srcref
->sizrange
[0];
1343 acs
.srcsiz
[1] = srcref
->sizrange
[1];
1345 /* Call the appropriate function to determine the overlap. */
1346 if ((this->*detect_overlap
) ())
1350 /* Unless the access size range has already been set, do so here. */
1351 sizrange
[0] = wi::smax (acs
.dstsiz
[0], srcref
->sizrange
[0]).to_shwi ();
1352 sizrange
[1] = wi::smax (acs
.dstsiz
[1], srcref
->sizrange
[1]).to_shwi ();
1360 /* Attempt to detect and diagnose an overlapping copy in a call expression
1361 EXPR involving an an access ACS to a built-in memory or string function.
1362 Return true when one has been detected, false otherwise. */
1365 maybe_diag_overlap (location_t loc
, gimple
*call
, builtin_access
&acs
)
1367 if (!acs
.overlap ())
1370 if (gimple_no_warning_p (call
))
1373 /* For convenience. */
1374 const builtin_memref
&dstref
= *acs
.dstref
;
1375 const builtin_memref
&srcref
= *acs
.srcref
;
1377 /* Determine the range of offsets and sizes of the overlap if it
1378 exists and issue diagnostics. */
1379 HOST_WIDE_INT
*ovloff
= acs
.ovloff
;
1380 HOST_WIDE_INT
*ovlsiz
= acs
.ovlsiz
;
1381 HOST_WIDE_INT
*sizrange
= acs
.sizrange
;
1383 tree func
= gimple_call_fndecl (call
);
1385 /* To avoid a combinatorial explosion of diagnostics format the offsets
1386 or their ranges as strings and use them in the warning calls below. */
1389 if (dstref
.offrange
[0] == dstref
.offrange
[1]
1390 || dstref
.offrange
[1] > HOST_WIDE_INT_MAX
)
1391 sprintf (offstr
[0], HOST_WIDE_INT_PRINT_DEC
,
1392 dstref
.offrange
[0].to_shwi ());
1395 "[" HOST_WIDE_INT_PRINT_DEC
", " HOST_WIDE_INT_PRINT_DEC
"]",
1396 dstref
.offrange
[0].to_shwi (),
1397 dstref
.offrange
[1].to_shwi ());
1399 if (srcref
.offrange
[0] == srcref
.offrange
[1]
1400 || srcref
.offrange
[1] > HOST_WIDE_INT_MAX
)
1402 HOST_WIDE_INT_PRINT_DEC
,
1403 srcref
.offrange
[0].to_shwi ());
1406 "[" HOST_WIDE_INT_PRINT_DEC
", " HOST_WIDE_INT_PRINT_DEC
"]",
1407 srcref
.offrange
[0].to_shwi (),
1408 srcref
.offrange
[1].to_shwi ());
1410 if (ovloff
[0] == ovloff
[1] || !ovloff
[1])
1411 sprintf (offstr
[2], HOST_WIDE_INT_PRINT_DEC
, ovloff
[0]);
1414 "[" HOST_WIDE_INT_PRINT_DEC
", " HOST_WIDE_INT_PRINT_DEC
"]",
1415 ovloff
[0], ovloff
[1]);
1417 const offset_int maxobjsize
= dstref
.maxobjsize
;
1418 bool must_overlap
= ovlsiz
[0] > 0;
1421 ovlsiz
[1] = ovlsiz
[0];
1425 /* Issue definitive "overlaps" diagnostic in this block. */
1427 if (sizrange
[0] == sizrange
[1])
1429 if (ovlsiz
[0] == ovlsiz
[1])
1430 warning_at (loc
, OPT_Wrestrict
,
1433 ? G_("%G%qD accessing %wu byte at offsets %s "
1434 "and %s overlaps %wu byte at offset %s")
1435 : G_("%G%qD accessing %wu byte at offsets %s "
1436 "and %s overlaps %wu bytes at offset "
1439 ? G_("%G%qD accessing %wu bytes at offsets %s "
1440 "and %s overlaps %wu byte at offset %s")
1441 : G_("%G%qD accessing %wu bytes at offsets %s "
1442 "and %s overlaps %wu bytes at offset "
1444 call
, func
, sizrange
[0],
1445 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1446 else if (ovlsiz
[1] >= 0 && ovlsiz
[1] < maxobjsize
.to_shwi ())
1447 warning_n (loc
, OPT_Wrestrict
, sizrange
[0],
1448 "%G%qD accessing %wu byte at offsets %s "
1449 "and %s overlaps between %wu and %wu bytes "
1451 "%G%qD accessing %wu bytes at offsets %s "
1452 "and %s overlaps between %wu and %wu bytes "
1454 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1455 ovlsiz
[0], ovlsiz
[1], offstr
[2]);
1457 warning_n (loc
, OPT_Wrestrict
, sizrange
[0],
1458 "%G%qD accessing %wu byte at offsets %s and "
1459 "%s overlaps %wu or more bytes at offset %s",
1460 "%G%qD accessing %wu bytes at offsets %s and "
1461 "%s overlaps %wu or more bytes at offset %s",
1462 call
, func
, sizrange
[0],
1463 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1467 if (sizrange
[1] >= 0 && sizrange
[1] < maxobjsize
.to_shwi ())
1469 if (ovlsiz
[0] == ovlsiz
[1])
1470 warning_n (loc
, OPT_Wrestrict
, ovlsiz
[0],
1471 "%G%qD accessing between %wu and %wu bytes "
1472 "at offsets %s and %s overlaps %wu byte at "
1474 "%G%qD accessing between %wu and %wu bytes "
1475 "at offsets %s and %s overlaps %wu bytes "
1477 call
, func
, sizrange
[0], sizrange
[1],
1478 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1479 else if (ovlsiz
[1] >= 0 && ovlsiz
[1] < maxobjsize
.to_shwi ())
1480 warning_at (loc
, OPT_Wrestrict
,
1481 "%G%qD accessing between %wu and %wu bytes at "
1482 "offsets %s and %s overlaps between %wu and %wu "
1483 "bytes at offset %s",
1484 call
, func
, sizrange
[0], sizrange
[1],
1485 offstr
[0], offstr
[1], ovlsiz
[0], ovlsiz
[1],
1488 warning_at (loc
, OPT_Wrestrict
,
1489 "%G%qD accessing between %wu and %wu bytes at "
1490 "offsets %s and %s overlaps %wu or more bytes "
1492 call
, func
, sizrange
[0], sizrange
[1],
1493 offstr
[0], offstr
[1], ovlsiz
[0], offstr
[2]);
1497 if (ovlsiz
[0] != ovlsiz
[1])
1498 ovlsiz
[1] = maxobjsize
.to_shwi ();
1500 if (ovlsiz
[0] == ovlsiz
[1])
1501 warning_n (loc
, OPT_Wrestrict
, ovlsiz
[0],
1502 "%G%qD accessing %wu or more bytes at offsets "
1503 "%s and %s overlaps %wu byte at offset %s",
1504 "%G%qD accessing %wu or more bytes at offsets "
1505 "%s and %s overlaps %wu bytes at offset %s",
1506 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1507 ovlsiz
[0], offstr
[2]);
1508 else if (ovlsiz
[1] >= 0 && ovlsiz
[1] < maxobjsize
.to_shwi ())
1509 warning_at (loc
, OPT_Wrestrict
,
1510 "%G%qD accessing %wu or more bytes at offsets %s "
1511 "and %s overlaps between %wu and %wu bytes "
1513 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1514 ovlsiz
[0], ovlsiz
[1], offstr
[2]);
1516 warning_at (loc
, OPT_Wrestrict
,
1517 "%G%qD accessing %wu or more bytes at offsets %s "
1518 "and %s overlaps %wu or more bytes at offset %s",
1519 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1520 ovlsiz
[0], offstr
[2]);
1524 /* Use more concise wording when one of the offsets is unbounded
1525 to avoid confusing the user with large and mostly meaningless
1528 if (DECL_P (dstref
.base
) && TREE_CODE (TREE_TYPE (dstref
.base
)) == ARRAY_TYPE
)
1529 open_range
= ((dstref
.offrange
[0] == 0
1530 && dstref
.offrange
[1] == maxobjsize
)
1531 || (srcref
.offrange
[0] == 0
1532 && srcref
.offrange
[1] == maxobjsize
));
1534 open_range
= ((dstref
.offrange
[0] == -maxobjsize
- 1
1535 && dstref
.offrange
[1] == maxobjsize
)
1536 || (srcref
.offrange
[0] == -maxobjsize
- 1
1537 && srcref
.offrange
[1] == maxobjsize
));
1539 if (sizrange
[0] == sizrange
[1] || sizrange
[1] == 1)
1544 warning_n (loc
, OPT_Wrestrict
, sizrange
[1],
1545 "%G%qD accessing %wu byte may overlap "
1547 "%G%qD accessing %wu bytes may overlap "
1549 call
, func
, sizrange
[1], ovlsiz
[1]);
1551 warning_n (loc
, OPT_Wrestrict
, sizrange
[1],
1552 "%G%qD accessing %wu byte at offsets %s "
1553 "and %s may overlap %wu byte at offset %s",
1554 "%G%qD accessing %wu bytes at offsets %s "
1555 "and %s may overlap %wu byte at offset %s",
1556 call
, func
, sizrange
[1], offstr
[0], offstr
[1],
1557 ovlsiz
[1], offstr
[2]);
1562 warning_n (loc
, OPT_Wrestrict
, sizrange
[1],
1563 "%G%qD accessing %wu byte may overlap "
1565 "%G%qD accessing %wu bytes may overlap "
1567 call
, func
, sizrange
[1], ovlsiz
[1]);
1569 warning_n (loc
, OPT_Wrestrict
, sizrange
[1],
1570 "%G%qD accessing %wu byte at offsets %s and "
1571 "%s may overlap up to %wu bytes at offset %s",
1572 "%G%qD accessing %wu bytes at offsets %s and "
1573 "%s may overlap up to %wu bytes at offset %s",
1574 call
, func
, sizrange
[1], offstr
[0], offstr
[1],
1575 ovlsiz
[1], offstr
[2]);
1579 if (sizrange
[1] >= 0 && sizrange
[1] < maxobjsize
.to_shwi ())
1582 warning_n (loc
, OPT_Wrestrict
, ovlsiz
[1],
1583 "%G%qD accessing between %wu and %wu bytes "
1584 "may overlap %wu byte",
1585 "%G%qD accessing between %wu and %wu bytes "
1586 "may overlap up to %wu bytes",
1587 call
, func
, sizrange
[0], sizrange
[1], ovlsiz
[1]);
1589 warning_n (loc
, OPT_Wrestrict
, ovlsiz
[1],
1590 "%G%qD accessing between %wu and %wu bytes "
1591 "at offsets %s and %s may overlap %wu byte "
1593 "%G%qD accessing between %wu and %wu bytes "
1594 "at offsets %s and %s may overlap up to %wu "
1595 "bytes at offset %s",
1596 call
, func
, sizrange
[0], sizrange
[1],
1597 offstr
[0], offstr
[1], ovlsiz
[1], offstr
[2]);
1601 warning_n (loc
, OPT_Wrestrict
, ovlsiz
[1],
1602 "%G%qD accessing %wu or more bytes at offsets %s "
1603 "and %s may overlap %wu byte at offset %s",
1604 "%G%qD accessing %wu or more bytes at offsets %s "
1605 "and %s may overlap up to %wu bytes at offset %s",
1606 call
, func
, sizrange
[0], offstr
[0], offstr
[1],
1607 ovlsiz
[1], offstr
[2]);
1612 /* Validate REF size and offsets in an expression passed as an argument
1613 to a CALL to a built-in function FUNC to make sure they are within
1614 the bounds of the referenced object if its size is known, or
1615 PTRDIFF_MAX otherwise. DO_WARN is true when a diagnostic should
1616 be issued, false otherwise.
1617 Both initial values of the offsets and their final value computed
1618 by the function by incrementing the initial value by the size are
1619 validated. Return true if the offsets are not valid and a diagnostic
1620 has been issued, or would have been issued if DO_WARN had been true. */
1623 maybe_diag_access_bounds (location_t loc
, gimple
*call
, tree func
, int strict
,
1624 const builtin_memref
&ref
, bool do_warn
)
1626 const offset_int maxobjsize
= ref
.maxobjsize
;
1628 /* Check for excessive size first and regardless of warning options
1629 since the result is used to make codegen decisions. */
1630 if (ref
.sizrange
[0] > maxobjsize
)
1632 /* Return true without issuing a warning. */
1636 if (ref
.ref
&& TREE_NO_WARNING (ref
.ref
))
1639 if (warn_stringop_overflow
)
1641 if (EXPR_HAS_LOCATION (ref
.ptr
))
1642 loc
= EXPR_LOCATION (ref
.ptr
);
1644 loc
= expansion_point_location_if_in_system_header (loc
);
1646 if (ref
.sizrange
[0] == ref
.sizrange
[1])
1647 return warning_at (loc
, OPT_Wstringop_overflow_
,
1648 "%G%qD specified bound %wu "
1649 "exceeds maximum object size %wu",
1650 call
, func
, ref
.sizrange
[0].to_uhwi (),
1651 maxobjsize
.to_uhwi ());
1653 return warning_at (loc
, OPT_Wstringop_overflow_
,
1654 "%G%qD specified bound between %wu and %wu "
1655 "exceeds maximum object size %wu",
1656 call
, func
, ref
.sizrange
[0].to_uhwi (),
1657 ref
.sizrange
[1].to_uhwi (),
1658 maxobjsize
.to_uhwi ());
1662 /* Check for out-bounds pointers regardless of warning options since
1663 the result is used to make codegen decisions. */
1664 offset_int ooboff
[] = { ref
.offrange
[0], ref
.offrange
[1] };
1665 tree oobref
= ref
.offset_out_of_bounds (strict
, ooboff
);
1669 /* Return true without issuing a warning. */
1673 if (!warn_array_bounds
)
1676 if (ref
.ref
&& TREE_NO_WARNING (ref
.ref
))
1679 if (EXPR_HAS_LOCATION (ref
.ptr
))
1680 loc
= EXPR_LOCATION (ref
.ptr
);
1682 loc
= expansion_point_location_if_in_system_header (loc
);
1684 char rangestr
[2][64];
1685 if (ooboff
[0] == ooboff
[1]
1686 || (ooboff
[0] != ref
.offrange
[0]
1687 && ooboff
[0].to_shwi () >= ooboff
[1].to_shwi ()))
1688 sprintf (rangestr
[0], "%lli", (long long) ooboff
[0].to_shwi ());
1690 sprintf (rangestr
[0], "[%lli, %lli]",
1691 (long long) ooboff
[0].to_shwi (),
1692 (long long) ooboff
[1].to_shwi ());
1694 bool warned
= false;
1696 if (oobref
== error_mark_node
)
1698 if (ref
.sizrange
[0] == ref
.sizrange
[1])
1699 sprintf (rangestr
[1], "%llu",
1700 (unsigned long long) ref
.sizrange
[0].to_shwi ());
1702 sprintf (rangestr
[1], "[%lli, %lli]",
1703 (unsigned long long) ref
.sizrange
[0].to_uhwi (),
1704 (unsigned long long) ref
.sizrange
[1].to_uhwi ());
1708 if (DECL_P (ref
.base
)
1709 && TREE_CODE (type
= TREE_TYPE (ref
.base
)) == ARRAY_TYPE
)
1711 auto_diagnostic_group d
;
1712 if (warning_at (loc
, OPT_Warray_bounds
,
1713 "%G%qD pointer overflow between offset %s "
1714 "and size %s accessing array %qD with type %qT",
1715 call
, func
, rangestr
[0], rangestr
[1], ref
.base
, type
))
1717 inform (DECL_SOURCE_LOCATION (ref
.base
),
1718 "array %qD declared here", ref
.base
);
1722 warned
= warning_at (loc
, OPT_Warray_bounds
,
1723 "%G%qD pointer overflow between offset %s "
1725 call
, func
, rangestr
[0], rangestr
[1]);
1728 warned
= warning_at (loc
, OPT_Warray_bounds
,
1729 "%G%qD pointer overflow between offset %s "
1731 call
, func
, rangestr
[0], rangestr
[1]);
1733 else if (oobref
== ref
.base
)
1735 /* True when the offset formed by an access to the reference
1736 is out of bounds, rather than the initial offset wich is
1737 in bounds. This implies access past the end. */
1738 bool form
= ooboff
[0] != ref
.offrange
[0];
1740 if (DECL_P (ref
.base
))
1742 auto_diagnostic_group d
;
1743 if ((ref
.basesize
< maxobjsize
1744 && warning_at (loc
, OPT_Warray_bounds
,
1746 ? G_("%G%qD forming offset %s is out of "
1747 "the bounds [0, %wu] of object %qD with "
1749 : G_("%G%qD offset %s is out of the bounds "
1750 "[0, %wu] of object %qD with type %qT"),
1751 call
, func
, rangestr
[0], ref
.basesize
.to_uhwi (),
1752 ref
.base
, TREE_TYPE (ref
.base
)))
1753 || warning_at (loc
, OPT_Warray_bounds
,
1755 ? G_("%G%qD forming offset %s is out of "
1756 "the bounds of object %qD with type %qT")
1757 : G_("%G%qD offset %s is out of the bounds "
1758 "of object %qD with type %qT"),
1759 call
, func
, rangestr
[0],
1760 ref
.base
, TREE_TYPE (ref
.base
)))
1762 inform (DECL_SOURCE_LOCATION (ref
.base
),
1763 "%qD declared here", ref
.base
);
1767 else if (ref
.basesize
< maxobjsize
)
1768 warned
= warning_at (loc
, OPT_Warray_bounds
,
1770 ? G_("%G%qD forming offset %s is out "
1771 "of the bounds [0, %wu]")
1772 : G_("%G%qD offset %s is out "
1773 "of the bounds [0, %wu]"),
1774 call
, func
, rangestr
[0], ref
.basesize
.to_uhwi ());
1776 warned
= warning_at (loc
, OPT_Warray_bounds
,
1778 ? G_("%G%qD forming offset %s is out of bounds")
1779 : G_("%G%qD offset %s is out of bounds"),
1780 call
, func
, rangestr
[0]);
1782 else if (TREE_CODE (ref
.ref
) == MEM_REF
)
1784 tree type
= TREE_TYPE (TREE_OPERAND (ref
.ref
, 0));
1785 if (POINTER_TYPE_P (type
))
1786 type
= TREE_TYPE (type
);
1787 type
= TYPE_MAIN_VARIANT (type
);
1789 warned
= warning_at (loc
, OPT_Warray_bounds
,
1790 "%G%qD offset %s from the object at %qE is out "
1791 "of the bounds of %qT",
1792 call
, func
, rangestr
[0], ref
.base
, type
);
1796 tree type
= TYPE_MAIN_VARIANT (TREE_TYPE (ref
.ref
));
1798 warned
= warning_at (loc
, OPT_Warray_bounds
,
1799 "%G%qD offset %s from the object at %qE is out "
1800 "of the bounds of referenced subobject %qD with "
1801 "type %qT at offset %wu",
1802 call
, func
, rangestr
[0], ref
.base
,
1803 TREE_OPERAND (ref
.ref
, 1), type
,
1804 ref
.refoff
.to_uhwi ());
1810 /* Check a CALL statement for restrict-violations and issue warnings
1811 if/when appropriate. */
1814 wrestrict_dom_walker::check_call (gimple
*call
)
1816 /* Avoid checking the call if it has already been diagnosed for
1818 if (gimple_no_warning_p (call
))
1821 tree func
= gimple_call_fndecl (call
);
1822 if (!func
|| !fndecl_built_in_p (func
, BUILT_IN_NORMAL
))
1825 /* Argument number to extract from the call (depends on the built-in
1827 unsigned dst_idx
= -1;
1828 unsigned src_idx
= -1;
1829 unsigned bnd_idx
= -1;
1831 /* Is this CALL to a string function (as opposed to one to a raw
1832 memory function). */
1835 switch (DECL_FUNCTION_CODE (func
))
1837 case BUILT_IN_MEMCPY
:
1838 case BUILT_IN_MEMCPY_CHK
:
1839 case BUILT_IN_MEMPCPY
:
1840 case BUILT_IN_MEMPCPY_CHK
:
1841 case BUILT_IN_MEMMOVE
:
1842 case BUILT_IN_MEMMOVE_CHK
:
1846 case BUILT_IN_STPNCPY
:
1847 case BUILT_IN_STPNCPY_CHK
:
1848 case BUILT_IN_STRNCAT
:
1849 case BUILT_IN_STRNCAT_CHK
:
1850 case BUILT_IN_STRNCPY
:
1851 case BUILT_IN_STRNCPY_CHK
:
1857 case BUILT_IN_MEMSET
:
1858 case BUILT_IN_MEMSET_CHK
:
1863 case BUILT_IN_STPCPY
:
1864 case BUILT_IN_STPCPY_CHK
:
1865 case BUILT_IN_STRCPY
:
1866 case BUILT_IN_STRCPY_CHK
:
1867 case BUILT_IN_STRCAT
:
1868 case BUILT_IN_STRCAT_CHK
:
1874 /* Handle other string functions here whose access may need
1875 to be validated for in-bounds offsets and non-overlapping
1880 unsigned nargs
= gimple_call_num_args (call
);
1882 tree dst
= dst_idx
< nargs
? gimple_call_arg (call
, dst_idx
) : NULL_TREE
;
1883 tree src
= src_idx
< nargs
? gimple_call_arg (call
, src_idx
) : NULL_TREE
;
1884 tree dstwr
= bnd_idx
< nargs
? gimple_call_arg (call
, bnd_idx
) : NULL_TREE
;
1886 /* For string functions with an unspecified or unknown bound,
1887 assume the size of the access is one. */
1888 if (!dstwr
&& strfun
)
1889 dstwr
= size_one_node
;
1891 /* DST and SRC can be null for a call with an insufficient number
1892 of arguments to a built-in function declared without a protype. */
1893 if (!dst
|| (src_idx
< nargs
&& !src
))
1896 /* DST, SRC, or DSTWR can also have the wrong type in a call to
1897 a function declared without a prototype. Avoid checking such
1899 if (TREE_CODE (TREE_TYPE (dst
)) != POINTER_TYPE
1900 || (src
&& TREE_CODE (TREE_TYPE (src
)) != POINTER_TYPE
)
1901 || (dstwr
&& !INTEGRAL_TYPE_P (TREE_TYPE (dstwr
))))
1904 if (!check_bounds_or_overlap (call
, dst
, src
, dstwr
, NULL_TREE
))
1907 /* Avoid diagnosing the call again. */
1908 gimple_set_no_warning (call
, true);
1911 } /* anonymous namespace */
1913 /* Attempt to detect and diagnose invalid offset bounds and (except for
1914 memmove) overlapping copy in a call expression EXPR from SRC to DST
1915 and DSTSIZE and SRCSIZE bytes, respectively. Both DSTSIZE and
1916 SRCSIZE may be NULL. DO_WARN is false to detect either problem
1917 without issue a warning. Return the OPT_Wxxx constant corresponding
1918 to the warning if one has been detected and zero otherwise. */
1921 check_bounds_or_overlap (gimple
*call
, tree dst
, tree src
, tree dstsize
,
1922 tree srcsize
, bool bounds_only
/* = false */,
1923 bool do_warn
/* = true */)
1925 location_t loc
= gimple_nonartificial_location (call
);
1926 loc
= expansion_point_location_if_in_system_header (loc
);
1928 tree func
= gimple_call_fndecl (call
);
1930 builtin_memref
dstref (dst
, dstsize
);
1931 builtin_memref
srcref (src
, srcsize
);
1933 builtin_access
acs (call
, dstref
, srcref
);
1935 /* Set STRICT to the value of the -Warray-bounds=N argument for
1936 string functions or when N > 1. */
1937 int strict
= (acs
.strict () || warn_array_bounds
> 1 ? warn_array_bounds
: 0);
1939 /* Validate offsets first to make sure they are within the bounds
1940 of the destination object if its size is known, or PTRDIFF_MAX
1942 if (maybe_diag_access_bounds (loc
, call
, func
, strict
, dstref
, do_warn
)
1943 || maybe_diag_access_bounds (loc
, call
, func
, strict
, srcref
, do_warn
))
1946 gimple_set_no_warning (call
, true);
1947 return OPT_Warray_bounds
;
1950 if (!warn_restrict
|| bounds_only
|| !src
)
1955 switch (DECL_FUNCTION_CODE (func
))
1957 case BUILT_IN_MEMMOVE
:
1958 case BUILT_IN_MEMMOVE_CHK
:
1959 case BUILT_IN_MEMSET
:
1960 case BUILT_IN_MEMSET_CHK
:
1967 if (operand_equal_p (dst
, src
, 0))
1969 /* Issue -Wrestrict unless the pointers are null (those do
1970 not point to objects and so do not indicate an overlap;
1971 such calls could be the result of sanitization and jump
1973 if (!integer_zerop (dst
) && !gimple_no_warning_p (call
))
1975 warning_at (loc
, OPT_Wrestrict
,
1976 "%G%qD source argument is the same as destination",
1978 gimple_set_no_warning (call
, true);
1979 return OPT_Wrestrict
;
1985 /* Return false when overlap has been detected. */
1986 if (maybe_diag_overlap (loc
, call
, acs
))
1988 gimple_set_no_warning (call
, true);
1989 return OPT_Wrestrict
;
1996 make_pass_warn_restrict (gcc::context
*ctxt
)
1998 return new pass_wrestrict (ctxt
);