1 /* Pass to detect and issue warnings for invalid accesses, including
2 invalid or mismatched allocation/deallocation calls.
4 Copyright (C) 2020-2022 Free Software Foundation, Inc.
5 Contributed by Martin Sebor <msebor@redhat.com>.
7 This file is part of GCC.
9 GCC is free software; you can redistribute it and/or modify it under
10 the terms of the GNU General Public License as published by the Free
11 Software Foundation; either version 3, or (at your option) any later
14 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
15 WARRANTY; without even the implied warranty of MERCHANTABILITY or
16 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
19 You should have received a copy of the GNU General Public License
20 along with GCC; see the file COPYING3. If not see
21 <http://www.gnu.org/licenses/>. */
23 #define INCLUDE_STRING
26 #include "coretypes.h"
30 #include "tree-pass.h"
32 #include "diagnostic.h"
34 #include "gimple-pretty-print.h"
35 #include "gimple-ssa-warn-access.h"
36 #include "gimple-ssa-warn-restrict.h"
37 #include "diagnostic-core.h"
38 #include "fold-const.h"
39 #include "gimple-fold.h"
40 #include "gimple-iterator.h"
41 #include "langhooks.h"
47 #include "tree-object-size.h"
48 #include "tree-ssa-strlen.h"
52 #include "gimple-range.h"
53 #include "stringpool.h"
56 #include "pointer-query.h"
58 /* Return true if tree node X has an associated location. */
60 static inline location_t
61 has_location (const_tree x
)
64 return DECL_SOURCE_LOCATION (x
) != UNKNOWN_LOCATION
;
67 return EXPR_HAS_LOCATION (x
);
72 /* Return the associated location of STMT. */
74 static inline location_t
75 get_location (const gimple
*stmt
)
77 return gimple_location (stmt
);
80 /* Return the associated location of tree node X. */
82 static inline location_t
86 return DECL_SOURCE_LOCATION (x
);
89 return EXPR_LOCATION (x
);
91 return UNKNOWN_LOCATION
;
94 /* Overload of the nascent tree function for GIMPLE STMT. */
97 get_callee_fndecl (const gimple
*stmt
)
99 return gimple_call_fndecl (stmt
);
102 static inline unsigned
103 call_nargs (const gimple
*stmt
)
105 return gimple_call_num_args (stmt
);
108 static inline unsigned
109 call_nargs (const_tree expr
)
111 return call_expr_nargs (expr
);
116 call_arg (const gimple
*stmt
, unsigned argno
)
118 return gimple_call_arg (stmt
, argno
);
122 call_arg (tree expr
, unsigned argno
)
124 return CALL_EXPR_ARG (expr
, argno
);
127 /* For a call EXPR at LOC to a function FNAME that expects a string
128 in the argument ARG, issue a diagnostic due to it being a called
129 with an argument that is a character array with no terminating
130 NUL. SIZE is the EXACT size of the array, and BNDRNG the number
131 of characters in which the NUL is expected. Either EXPR or FNAME
132 may be null but noth both. SIZE may be null when BNDRNG is null. */
134 template <class GimpleOrTree
>
136 warn_string_no_nul (location_t loc
, GimpleOrTree expr
, const char *fname
,
137 tree arg
, tree decl
, tree size
, bool exact
,
138 const wide_int bndrng
[2] /* = NULL */)
140 const opt_code opt
= OPT_Wstringop_overread
;
141 if ((expr
&& warning_suppressed_p (expr
, opt
))
142 || warning_suppressed_p (arg
, opt
))
145 loc
= expansion_point_location_if_in_system_header (loc
);
148 /* Format the bound range as a string to keep the nuber of messages
154 if (bndrng
[0] == bndrng
[1])
155 sprintf (bndstr
, "%llu", (unsigned long long) bndrng
[0].to_uhwi ());
157 sprintf (bndstr
, "[%llu, %llu]",
158 (unsigned long long) bndrng
[0].to_uhwi (),
159 (unsigned long long) bndrng
[1].to_uhwi ());
162 const tree maxobjsize
= max_object_size ();
163 const wide_int maxsiz
= wi::to_wide (maxobjsize
);
166 tree func
= get_callee_fndecl (expr
);
169 if (wi::ltu_p (maxsiz
, bndrng
[0]))
170 warned
= warning_at (loc
, opt
,
171 "%qD specified bound %s exceeds "
172 "maximum object size %E",
173 func
, bndstr
, maxobjsize
);
176 bool maybe
= wi::to_wide (size
) == bndrng
[0];
177 warned
= warning_at (loc
, opt
,
179 ? G_("%qD specified bound %s exceeds "
180 "the size %E of unterminated array")
182 ? G_("%qD specified bound %s may "
183 "exceed the size of at most %E "
184 "of unterminated array")
185 : G_("%qD specified bound %s exceeds "
186 "the size of at most %E "
187 "of unterminated array")),
192 warned
= warning_at (loc
, opt
,
193 "%qD argument missing terminating nul",
200 if (wi::ltu_p (maxsiz
, bndrng
[0]))
201 warned
= warning_at (loc
, opt
,
202 "%qs specified bound %s exceeds "
203 "maximum object size %E",
204 fname
, bndstr
, maxobjsize
);
207 bool maybe
= wi::to_wide (size
) == bndrng
[0];
208 warned
= warning_at (loc
, opt
,
210 ? G_("%qs specified bound %s exceeds "
211 "the size %E of unterminated array")
213 ? G_("%qs specified bound %s may "
214 "exceed the size of at most %E "
215 "of unterminated array")
216 : G_("%qs specified bound %s exceeds "
217 "the size of at most %E "
218 "of unterminated array")),
219 fname
, bndstr
, size
);
223 warned
= warning_at (loc
, opt
,
224 "%qs argument missing terminating nul",
230 inform (get_location (decl
),
231 "referenced argument declared here");
232 suppress_warning (arg
, opt
);
234 suppress_warning (expr
, opt
);
239 warn_string_no_nul (location_t loc
, gimple
*stmt
, const char *fname
,
240 tree arg
, tree decl
, tree size
/* = NULL_TREE */,
241 bool exact
/* = false */,
242 const wide_int bndrng
[2] /* = NULL */)
244 return warn_string_no_nul
<gimple
*> (loc
, stmt
, fname
,
245 arg
, decl
, size
, exact
, bndrng
);
249 warn_string_no_nul (location_t loc
, tree expr
, const char *fname
,
250 tree arg
, tree decl
, tree size
/* = NULL_TREE */,
251 bool exact
/* = false */,
252 const wide_int bndrng
[2] /* = NULL */)
254 return warn_string_no_nul
<tree
> (loc
, expr
, fname
,
255 arg
, decl
, size
, exact
, bndrng
);
258 /* If EXP refers to an unterminated constant character array return
259 the declaration of the object of which the array is a member or
260 element and if SIZE is not null, set *SIZE to the size of
261 the unterminated array and set *EXACT if the size is exact or
262 clear it otherwise. Otherwise return null. */
265 unterminated_array (tree exp
, tree
*size
/* = NULL */, bool *exact
/* = NULL */)
267 /* C_STRLEN will return NULL and set DECL in the info
268 structure if EXP references a unterminated array. */
269 c_strlen_data lendata
= { };
270 tree len
= c_strlen (exp
, 1, &lendata
);
271 if (len
|| !lendata
.minlen
|| !lendata
.decl
)
277 len
= lendata
.minlen
;
280 /* Constant offsets are already accounted for in LENDATA.MINLEN,
281 but not in a SSA_NAME + CST expression. */
282 if (TREE_CODE (lendata
.off
) == INTEGER_CST
)
284 else if (TREE_CODE (lendata
.off
) == PLUS_EXPR
285 && TREE_CODE (TREE_OPERAND (lendata
.off
, 1)) == INTEGER_CST
)
287 /* Subtract the offset from the size of the array. */
289 tree temp
= TREE_OPERAND (lendata
.off
, 1);
290 temp
= fold_convert (ssizetype
, temp
);
291 len
= fold_build2 (MINUS_EXPR
, ssizetype
, len
, temp
);
303 /* For a call EXPR (which may be null) that expects a string argument
304 SRC as an argument, returns false if SRC is a character array with
305 no terminating NUL. When nonnull, BOUND is the number of characters
306 in which to expect the terminating NUL. When EXPR is nonnull also
309 template <class GimpleOrTree
>
311 check_nul_terminated_array (GimpleOrTree expr
, tree src
, tree bound
)
313 /* The constant size of the array SRC points to. The actual size
314 may be less of EXACT is true, but not more. */
316 /* True if SRC involves a non-constant offset into the array. */
318 /* The unterminated constant array SRC points to. */
319 tree nonstr
= unterminated_array (src
, &size
, &exact
);
323 /* NONSTR refers to the non-nul terminated constant array and SIZE
324 is the constant size of the array in bytes. EXACT is true when
332 get_global_range_query ()->range_of_expr (r
, bound
);
334 if (r
.kind () != VR_RANGE
)
337 bndrng
[0] = r
.lower_bound ();
338 bndrng
[1] = r
.upper_bound ();
342 if (wi::leu_p (bndrng
[0], wi::to_wide (size
)))
345 else if (wi::lt_p (bndrng
[0], wi::to_wide (size
), UNSIGNED
))
350 warn_string_no_nul (get_location (expr
), expr
, NULL
, src
, nonstr
,
351 size
, exact
, bound
? bndrng
: NULL
);
357 check_nul_terminated_array (gimple
*stmt
, tree src
, tree bound
/* = NULL_TREE */)
359 return check_nul_terminated_array
<gimple
*>(stmt
, src
, bound
);
363 check_nul_terminated_array (tree expr
, tree src
, tree bound
/* = NULL_TREE */)
365 return check_nul_terminated_array
<tree
>(expr
, src
, bound
);
368 /* Warn about passing a non-string array/pointer to a built-in function
369 that expects a nul-terminated string argument. Returns true if
370 a warning has been issued.*/
372 template <class GimpleOrTree
>
374 maybe_warn_nonstring_arg (tree fndecl
, GimpleOrTree exp
)
376 if (!fndecl
|| !fndecl_built_in_p (fndecl
, BUILT_IN_NORMAL
))
379 if (!warn_stringop_overread
380 || warning_suppressed_p (exp
, OPT_Wstringop_overread
))
383 /* Avoid clearly invalid calls (more checking done below). */
384 unsigned nargs
= call_nargs (exp
);
388 /* The bound argument to a bounded string function like strncpy. */
389 tree bound
= NULL_TREE
;
391 /* The longest known or possible string argument to one of the comparison
392 functions. If the length is less than the bound it is used instead.
393 Since the length is only used for warning and not for code generation
394 disable strict mode in the calls to get_range_strlen below. */
395 tree maxlen
= NULL_TREE
;
397 /* It's safe to call "bounded" string functions with a non-string
398 argument since the functions provide an explicit bound for this
399 purpose. The exception is strncat where the bound may refer to
400 either the destination or the source. */
401 int fncode
= DECL_FUNCTION_CODE (fndecl
);
404 case BUILT_IN_STRCMP
:
405 case BUILT_IN_STRNCMP
:
406 case BUILT_IN_STRNCASECMP
:
408 /* For these, if one argument refers to one or more of a set
409 of string constants or arrays of known size, determine
410 the range of their known or possible lengths and use it
411 conservatively as the bound for the unbounded function,
412 and to adjust the range of the bound of the bounded ones. */
413 for (unsigned argno
= 0;
414 argno
< MIN (nargs
, 2)
415 && !(maxlen
&& TREE_CODE (maxlen
) == INTEGER_CST
); argno
++)
417 tree arg
= call_arg (exp
, argno
);
418 if (!get_attr_nonstring_decl (arg
))
420 c_strlen_data lendata
= { };
421 /* Set MAXBOUND to an arbitrary non-null non-integer
422 node as a request to have it set to the length of
423 the longest string in a PHI. */
424 lendata
.maxbound
= arg
;
425 get_range_strlen (arg
, &lendata
, /* eltsize = */ 1);
426 maxlen
= lendata
.maxbound
;
432 case BUILT_IN_STRNCAT
:
433 case BUILT_IN_STPNCPY
:
434 case BUILT_IN_STRNCPY
:
436 bound
= call_arg (exp
, 2);
439 case BUILT_IN_STRNDUP
:
442 bound
= call_arg (exp
, 1);
445 case BUILT_IN_STRNLEN
:
447 tree arg
= call_arg (exp
, 0);
448 if (!get_attr_nonstring_decl (arg
))
450 c_strlen_data lendata
= { };
451 /* Set MAXBOUND to an arbitrary non-null non-integer
452 node as a request to have it set to the length of
453 the longest string in a PHI. */
454 lendata
.maxbound
= arg
;
455 get_range_strlen (arg
, &lendata
, /* eltsize = */ 1);
456 maxlen
= lendata
.maxbound
;
459 bound
= call_arg (exp
, 1);
467 /* Determine the range of the bound argument (if specified). */
468 tree bndrng
[2] = { NULL_TREE
, NULL_TREE
};
472 get_size_range (bound
, bndrng
);
475 location_t loc
= get_location (exp
);
479 /* Diagnose excessive bound prior to the adjustment below and
480 regardless of attribute nonstring. */
481 tree maxobjsize
= max_object_size ();
482 if (tree_int_cst_lt (maxobjsize
, bndrng
[0]))
485 if (tree_int_cst_equal (bndrng
[0], bndrng
[1]))
486 warned
= warning_at (loc
, OPT_Wstringop_overread
,
487 "%qD specified bound %E "
488 "exceeds maximum object size %E",
489 fndecl
, bndrng
[0], maxobjsize
);
491 warned
= warning_at (loc
, OPT_Wstringop_overread
,
492 "%qD specified bound [%E, %E] "
493 "exceeds maximum object size %E",
494 fndecl
, bndrng
[0], bndrng
[1],
497 suppress_warning (exp
, OPT_Wstringop_overread
);
503 if (maxlen
&& !integer_all_onesp (maxlen
))
505 /* Add one for the nul. */
506 maxlen
= const_binop (PLUS_EXPR
, TREE_TYPE (maxlen
), maxlen
,
511 /* Conservatively use the upper bound of the lengths for
512 both the lower and the upper bound of the operation. */
515 bound
= void_type_node
;
519 /* Replace the bound on the operation with the upper bound
520 of the length of the string if the latter is smaller. */
521 if (tree_int_cst_lt (maxlen
, bndrng
[0]))
523 else if (tree_int_cst_lt (maxlen
, bndrng
[1]))
528 bool any_arg_warned
= false;
529 /* Iterate over the built-in function's formal arguments and check
530 each const char* against the actual argument. If the actual
531 argument is declared attribute non-string issue a warning unless
532 the argument's maximum length is bounded. */
533 function_args_iterator it
;
534 function_args_iter_init (&it
, TREE_TYPE (fndecl
));
536 for (unsigned argno
= 0; ; ++argno
, function_args_iter_next (&it
))
538 /* Avoid iterating past the declared argument in a call
539 to function declared without a prototype. */
543 tree argtype
= function_args_iter_cond (&it
);
547 if (TREE_CODE (argtype
) != POINTER_TYPE
)
550 argtype
= TREE_TYPE (argtype
);
552 if (TREE_CODE (argtype
) != INTEGER_TYPE
553 || !TYPE_READONLY (argtype
))
556 argtype
= TYPE_MAIN_VARIANT (argtype
);
557 if (argtype
!= char_type_node
)
560 tree callarg
= call_arg (exp
, argno
);
561 if (TREE_CODE (callarg
) == ADDR_EXPR
)
562 callarg
= TREE_OPERAND (callarg
, 0);
564 /* See if the destination is declared with attribute "nonstring". */
565 tree decl
= get_attr_nonstring_decl (callarg
);
569 /* The maximum number of array elements accessed. */
570 offset_int wibnd
= 0;
572 if (argno
&& fncode
== BUILT_IN_STRNCAT
)
574 /* See if the bound in strncat is derived from the length
575 of the strlen of the destination (as it's expected to be).
576 If so, reset BOUND and FNCODE to trigger a warning. */
577 tree dstarg
= call_arg (exp
, 0);
578 if (is_strlen_related_p (dstarg
, bound
))
580 /* The bound applies to the destination, not to the source,
581 so reset these to trigger a warning without mentioning
587 /* Use the upper bound of the range for strncat. */
588 wibnd
= wi::to_offset (bndrng
[1]);
591 /* Use the lower bound of the range for functions other than
593 wibnd
= wi::to_offset (bndrng
[0]);
595 /* Determine the size of the argument array if it is one. */
596 offset_int asize
= wibnd
;
597 bool known_size
= false;
598 tree type
= TREE_TYPE (decl
);
600 /* Determine the array size. For arrays of unknown bound and
601 pointers reset BOUND to trigger the appropriate warning. */
602 if (TREE_CODE (type
) == ARRAY_TYPE
)
604 if (tree arrbnd
= TYPE_DOMAIN (type
))
606 if ((arrbnd
= TYPE_MAX_VALUE (arrbnd
)))
608 asize
= wi::to_offset (arrbnd
) + 1;
612 else if (bound
== void_type_node
)
615 else if (bound
== void_type_node
)
618 /* In a call to strncat with a bound in a range whose lower but
619 not upper bound is less than the array size, reset ASIZE to
620 be the same as the bound and the other variable to trigger
621 the apprpriate warning below. */
622 if (fncode
== BUILT_IN_STRNCAT
623 && bndrng
[0] != bndrng
[1]
624 && wi::ltu_p (wi::to_offset (bndrng
[0]), asize
)
626 || wi::ltu_p (asize
, wibnd
)))
635 auto_diagnostic_group d
;
636 if (wi::ltu_p (asize
, wibnd
))
638 if (bndrng
[0] == bndrng
[1])
639 warned
= warning_at (loc
, OPT_Wstringop_overread
,
640 "%qD argument %i declared attribute "
641 "%<nonstring%> is smaller than the specified "
643 fndecl
, argno
+ 1, wibnd
.to_uhwi ());
644 else if (wi::ltu_p (asize
, wi::to_offset (bndrng
[0])))
645 warned
= warning_at (loc
, OPT_Wstringop_overread
,
646 "%qD argument %i declared attribute "
647 "%<nonstring%> is smaller than "
648 "the specified bound [%E, %E]",
649 fndecl
, argno
+ 1, bndrng
[0], bndrng
[1]);
651 warned
= warning_at (loc
, OPT_Wstringop_overread
,
652 "%qD argument %i declared attribute "
653 "%<nonstring%> may be smaller than "
654 "the specified bound [%E, %E]",
655 fndecl
, argno
+ 1, bndrng
[0], bndrng
[1]);
657 else if (fncode
== BUILT_IN_STRNCAT
)
658 ; /* Avoid warning for calls to strncat() when the bound
659 is equal to the size of the non-string argument. */
661 warned
= warning_at (loc
, OPT_Wstringop_overread
,
662 "%qD argument %i declared attribute %<nonstring%>",
667 inform (DECL_SOURCE_LOCATION (decl
),
668 "argument %qD declared here", decl
);
669 any_arg_warned
= true;
674 suppress_warning (exp
, OPT_Wstringop_overread
);
676 return any_arg_warned
;
680 maybe_warn_nonstring_arg (tree fndecl
, gimple
*stmt
)
682 return maybe_warn_nonstring_arg
<gimple
*>(fndecl
, stmt
);
687 maybe_warn_nonstring_arg (tree fndecl
, tree expr
)
689 return maybe_warn_nonstring_arg
<tree
>(fndecl
, expr
);
692 /* Issue a warning OPT for a bounded call EXP with a bound in RANGE
693 accessing an object with SIZE. */
695 template <class GimpleOrTree
>
697 maybe_warn_for_bound (opt_code opt
, location_t loc
, GimpleOrTree exp
, tree func
,
698 tree bndrng
[2], tree size
, const access_data
*pad
)
700 if (!bndrng
[0] || warning_suppressed_p (exp
, opt
))
703 tree maxobjsize
= max_object_size ();
707 if (opt
== OPT_Wstringop_overread
)
709 bool maybe
= pad
&& pad
->src
.phi ();
712 /* Issue a "maybe" warning only if the PHI refers to objects
713 at least one of which has more space remaining than the bound.
714 Otherwise, if the bound is greater, use the definitive form. */
715 offset_int remmax
= pad
->src
.size_remaining ();
716 if (remmax
< wi::to_offset (bndrng
[0]))
720 if (tree_int_cst_lt (maxobjsize
, bndrng
[0]))
722 if (bndrng
[0] == bndrng
[1])
724 ? warning_at (loc
, opt
,
726 ? G_("%qD specified bound %E may "
727 "exceed maximum object size %E")
728 : G_("%qD specified bound %E "
729 "exceeds maximum object size %E")),
730 func
, bndrng
[0], maxobjsize
)
731 : warning_at (loc
, opt
,
733 ? G_("specified bound %E may "
734 "exceed maximum object size %E")
735 : G_("specified bound %E "
736 "exceeds maximum object size %E")),
737 bndrng
[0], maxobjsize
));
740 ? warning_at (loc
, opt
,
742 ? G_("%qD specified bound [%E, %E] may "
743 "exceed maximum object size %E")
744 : G_("%qD specified bound [%E, %E] "
745 "exceeds maximum object size %E")),
747 bndrng
[0], bndrng
[1], maxobjsize
)
748 : warning_at (loc
, opt
,
750 ? G_("specified bound [%E, %E] may "
751 "exceed maximum object size %E")
752 : G_("specified bound [%E, %E] "
753 "exceeds maximum object size %E")),
754 bndrng
[0], bndrng
[1], maxobjsize
));
756 else if (!size
|| tree_int_cst_le (bndrng
[0], size
))
758 else if (tree_int_cst_equal (bndrng
[0], bndrng
[1]))
760 ? warning_at (loc
, opt
,
762 ? G_("%qD specified bound %E may exceed "
764 : G_("%qD specified bound %E exceeds "
766 func
, bndrng
[0], size
)
767 : warning_at (loc
, opt
,
769 ? G_("specified bound %E may exceed "
771 : G_("specified bound %E exceeds "
776 ? warning_at (loc
, opt
,
778 ? G_("%qD specified bound [%E, %E] may "
779 "exceed source size %E")
780 : G_("%qD specified bound [%E, %E] exceeds "
782 func
, bndrng
[0], bndrng
[1], size
)
783 : warning_at (loc
, opt
,
785 ? G_("specified bound [%E, %E] may exceed "
787 : G_("specified bound [%E, %E] exceeds "
789 bndrng
[0], bndrng
[1], size
));
792 if (pad
&& pad
->src
.ref
793 && has_location (pad
->src
.ref
))
794 inform (get_location (pad
->src
.ref
),
795 "source object allocated here");
796 suppress_warning (exp
, opt
);
802 bool maybe
= pad
&& pad
->dst
.phi ();
805 /* Issue a "maybe" warning only if the PHI refers to objects
806 at least one of which has more space remaining than the bound.
807 Otherwise, if the bound is greater, use the definitive form. */
808 offset_int remmax
= pad
->dst
.size_remaining ();
809 if (remmax
< wi::to_offset (bndrng
[0]))
812 if (tree_int_cst_lt (maxobjsize
, bndrng
[0]))
814 if (bndrng
[0] == bndrng
[1])
816 ? warning_at (loc
, opt
,
818 ? G_("%qD specified size %E may "
819 "exceed maximum object size %E")
820 : G_("%qD specified size %E "
821 "exceeds maximum object size %E")),
822 func
, bndrng
[0], maxobjsize
)
823 : warning_at (loc
, opt
,
825 ? G_("specified size %E may exceed "
826 "maximum object size %E")
827 : G_("specified size %E exceeds "
828 "maximum object size %E")),
829 bndrng
[0], maxobjsize
));
832 ? warning_at (loc
, opt
,
834 ? G_("%qD specified size between %E and %E "
835 "may exceed maximum object size %E")
836 : G_("%qD specified size between %E and %E "
837 "exceeds maximum object size %E")),
838 func
, bndrng
[0], bndrng
[1], maxobjsize
)
839 : warning_at (loc
, opt
,
841 ? G_("specified size between %E and %E "
842 "may exceed maximum object size %E")
843 : G_("specified size between %E and %E "
844 "exceeds maximum object size %E")),
845 bndrng
[0], bndrng
[1], maxobjsize
));
847 else if (!size
|| tree_int_cst_le (bndrng
[0], size
))
849 else if (tree_int_cst_equal (bndrng
[0], bndrng
[1]))
851 ? warning_at (loc
, opt
,
853 ? G_("%qD specified bound %E may exceed "
854 "destination size %E")
855 : G_("%qD specified bound %E exceeds "
856 "destination size %E")),
857 func
, bndrng
[0], size
)
858 : warning_at (loc
, opt
,
860 ? G_("specified bound %E may exceed "
861 "destination size %E")
862 : G_("specified bound %E exceeds "
863 "destination size %E")),
867 ? warning_at (loc
, opt
,
869 ? G_("%qD specified bound [%E, %E] may exceed "
870 "destination size %E")
871 : G_("%qD specified bound [%E, %E] exceeds "
872 "destination size %E")),
873 func
, bndrng
[0], bndrng
[1], size
)
874 : warning_at (loc
, opt
,
876 ? G_("specified bound [%E, %E] exceeds "
877 "destination size %E")
878 : G_("specified bound [%E, %E] exceeds "
879 "destination size %E")),
880 bndrng
[0], bndrng
[1], size
));
884 if (pad
&& pad
->dst
.ref
885 && has_location (pad
->dst
.ref
))
886 inform (get_location (pad
->dst
.ref
),
887 "destination object allocated here");
888 suppress_warning (exp
, opt
);
895 maybe_warn_for_bound (opt_code opt
, location_t loc
, gimple
*stmt
, tree func
,
896 tree bndrng
[2], tree size
,
897 const access_data
*pad
/* = NULL */)
899 return maybe_warn_for_bound
<gimple
*> (opt
, loc
, stmt
, func
, bndrng
, size
,
904 maybe_warn_for_bound (opt_code opt
, location_t loc
, tree expr
, tree func
,
905 tree bndrng
[2], tree size
,
906 const access_data
*pad
/* = NULL */)
908 return maybe_warn_for_bound
<tree
> (opt
, loc
, expr
, func
, bndrng
, size
, pad
);
911 /* For an expression EXP issue an access warning controlled by option OPT
912 with access to a region SIZE bytes in size in the RANGE of sizes.
913 WRITE is true for a write access, READ for a read access, neither for
914 call that may or may not perform an access but for which the range
915 is expected to valid.
916 Returns true when a warning has been issued. */
918 template <class GimpleOrTree
>
920 warn_for_access (location_t loc
, tree func
, GimpleOrTree exp
, int opt
,
921 tree range
[2], tree size
, bool write
, bool read
, bool maybe
)
927 if (tree_int_cst_equal (range
[0], range
[1]))
929 ? warning_n (loc
, opt
, tree_to_uhwi (range
[0]),
931 ? G_("%qD may access %E byte in a region "
933 : G_("%qD accessing %E byte in a region "
936 ? G_ ("%qD may access %E bytes in a region "
938 : G_ ("%qD accessing %E bytes in a region "
940 func
, range
[0], size
)
941 : warning_n (loc
, opt
, tree_to_uhwi (range
[0]),
943 ? G_("may access %E byte in a region "
945 : G_("accessing %E byte in a region "
948 ? G_("may access %E bytes in a region "
950 : G_("accessing %E bytes in a region "
953 else if (tree_int_cst_sign_bit (range
[1]))
955 /* Avoid printing the upper bound if it's invalid. */
957 ? warning_at (loc
, opt
,
959 ? G_("%qD may access %E or more bytes "
960 "in a region of size %E")
961 : G_("%qD accessing %E or more bytes "
962 "in a region of size %E")),
963 func
, range
[0], size
)
964 : warning_at (loc
, opt
,
966 ? G_("may access %E or more bytes "
967 "in a region of size %E")
968 : G_("accessing %E or more bytes "
969 "in a region of size %E")),
974 ? warning_at (loc
, opt
,
976 ? G_("%qD may access between %E and %E "
977 "bytes in a region of size %E")
978 : G_("%qD accessing between %E and %E "
979 "bytes in a region of size %E")),
980 func
, range
[0], range
[1], size
)
981 : warning_at (loc
, opt
,
983 ? G_("may access between %E and %E bytes "
984 "in a region of size %E")
985 : G_("accessing between %E and %E bytes "
986 "in a region of size %E")),
987 range
[0], range
[1], size
));
993 if (tree_int_cst_equal (range
[0], range
[1]))
995 ? warning_n (loc
, opt
, tree_to_uhwi (range
[0]),
997 ? G_("%qD may write %E byte into a region "
999 : G_("%qD writing %E byte into a region "
1000 "of size %E overflows the destination")),
1002 ? G_("%qD may write %E bytes into a region "
1004 : G_("%qD writing %E bytes into a region "
1005 "of size %E overflows the destination")),
1006 func
, range
[0], size
)
1007 : warning_n (loc
, opt
, tree_to_uhwi (range
[0]),
1009 ? G_("may write %E byte into a region "
1011 : G_("writing %E byte into a region "
1012 "of size %E overflows the destination")),
1014 ? G_("may write %E bytes into a region "
1016 : G_("writing %E bytes into a region "
1017 "of size %E overflows the destination")),
1019 else if (tree_int_cst_sign_bit (range
[1]))
1021 /* Avoid printing the upper bound if it's invalid. */
1023 ? warning_at (loc
, opt
,
1025 ? G_("%qD may write %E or more bytes "
1026 "into a region of size %E")
1027 : G_("%qD writing %E or more bytes "
1028 "into a region of size %E overflows "
1029 "the destination")),
1030 func
, range
[0], size
)
1031 : warning_at (loc
, opt
,
1033 ? G_("may write %E or more bytes into "
1034 "a region of size %E")
1035 : G_("writing %E or more bytes into "
1036 "a region of size %E overflows "
1037 "the destination")),
1042 ? warning_at (loc
, opt
,
1044 ? G_("%qD may write between %E and %E bytes "
1045 "into a region of size %E")
1046 : G_("%qD writing between %E and %E bytes "
1047 "into a region of size %E overflows "
1048 "the destination")),
1049 func
, range
[0], range
[1], size
)
1050 : warning_at (loc
, opt
,
1052 ? G_("may write between %E and %E bytes "
1053 "into a region of size %E")
1054 : G_("writing between %E and %E bytes "
1055 "into a region of size %E overflows "
1056 "the destination")),
1057 range
[0], range
[1], size
));
1063 if (tree_int_cst_equal (range
[0], range
[1]))
1065 ? warning_n (loc
, OPT_Wstringop_overread
,
1066 tree_to_uhwi (range
[0]),
1068 ? G_("%qD may read %E byte from a region "
1070 : G_("%qD reading %E byte from a region "
1073 ? G_("%qD may read %E bytes from a region "
1075 : G_("%qD reading %E bytes from a region "
1077 func
, range
[0], size
)
1078 : warning_n (loc
, OPT_Wstringop_overread
,
1079 tree_to_uhwi (range
[0]),
1081 ? G_("may read %E byte from a region "
1083 : G_("reading %E byte from a region "
1086 ? G_("may read %E bytes from a region "
1088 : G_("reading %E bytes from a region "
1091 else if (tree_int_cst_sign_bit (range
[1]))
1093 /* Avoid printing the upper bound if it's invalid. */
1095 ? warning_at (loc
, OPT_Wstringop_overread
,
1097 ? G_("%qD may read %E or more bytes "
1098 "from a region of size %E")
1099 : G_("%qD reading %E or more bytes "
1100 "from a region of size %E")),
1101 func
, range
[0], size
)
1102 : warning_at (loc
, OPT_Wstringop_overread
,
1104 ? G_("may read %E or more bytes "
1105 "from a region of size %E")
1106 : G_("reading %E or more bytes "
1107 "from a region of size %E")),
1112 ? warning_at (loc
, OPT_Wstringop_overread
,
1114 ? G_("%qD may read between %E and %E bytes "
1115 "from a region of size %E")
1116 : G_("%qD reading between %E and %E bytes "
1117 "from a region of size %E")),
1118 func
, range
[0], range
[1], size
)
1119 : warning_at (loc
, opt
,
1121 ? G_("may read between %E and %E bytes "
1122 "from a region of size %E")
1123 : G_("reading between %E and %E bytes "
1124 "from a region of size %E")),
1125 range
[0], range
[1], size
));
1128 suppress_warning (exp
, OPT_Wstringop_overread
);
1133 if (tree_int_cst_equal (range
[0], range
[1])
1134 || tree_int_cst_sign_bit (range
[1]))
1136 ? warning_n (loc
, OPT_Wstringop_overread
,
1137 tree_to_uhwi (range
[0]),
1138 "%qD expecting %E byte in a region of size %E",
1139 "%qD expecting %E bytes in a region of size %E",
1140 func
, range
[0], size
)
1141 : warning_n (loc
, OPT_Wstringop_overread
,
1142 tree_to_uhwi (range
[0]),
1143 "expecting %E byte in a region of size %E",
1144 "expecting %E bytes in a region of size %E",
1146 else if (tree_int_cst_sign_bit (range
[1]))
1148 /* Avoid printing the upper bound if it's invalid. */
1150 ? warning_at (loc
, OPT_Wstringop_overread
,
1151 "%qD expecting %E or more bytes in a region "
1153 func
, range
[0], size
)
1154 : warning_at (loc
, OPT_Wstringop_overread
,
1155 "expecting %E or more bytes in a region "
1161 ? warning_at (loc
, OPT_Wstringop_overread
,
1162 "%qD expecting between %E and %E bytes in "
1163 "a region of size %E",
1164 func
, range
[0], range
[1], size
)
1165 : warning_at (loc
, OPT_Wstringop_overread
,
1166 "expecting between %E and %E bytes in "
1167 "a region of size %E",
1168 range
[0], range
[1], size
));
1171 suppress_warning (exp
, OPT_Wstringop_overread
);
1177 warn_for_access (location_t loc
, tree func
, gimple
*stmt
, int opt
,
1178 tree range
[2], tree size
, bool write
, bool read
, bool maybe
)
1180 return warn_for_access
<gimple
*>(loc
, func
, stmt
, opt
, range
, size
,
1181 write
, read
, maybe
);
1185 warn_for_access (location_t loc
, tree func
, tree expr
, int opt
,
1186 tree range
[2], tree size
, bool write
, bool read
, bool maybe
)
1188 return warn_for_access
<tree
>(loc
, func
, expr
, opt
, range
, size
,
1189 write
, read
, maybe
);
1192 /* Helper to set RANGE to the range of BOUND if it's nonnull, bounded
1193 by BNDRNG if nonnull and valid. */
1196 get_size_range (range_query
*query
, tree bound
, gimple
*stmt
, tree range
[2],
1197 const offset_int bndrng
[2])
1200 get_size_range (query
, bound
, stmt
, range
);
1202 if (!bndrng
|| (bndrng
[0] == 0 && bndrng
[1] == HOST_WIDE_INT_M1U
))
1205 if (range
[0] && TREE_CODE (range
[0]) == INTEGER_CST
)
1208 { wi::to_offset (range
[0]), wi::to_offset (range
[1]) };
1209 if (r
[0] < bndrng
[0])
1210 range
[0] = wide_int_to_tree (sizetype
, bndrng
[0]);
1211 if (bndrng
[1] < r
[1])
1212 range
[1] = wide_int_to_tree (sizetype
, bndrng
[1]);
1216 range
[0] = wide_int_to_tree (sizetype
, bndrng
[0]);
1217 range
[1] = wide_int_to_tree (sizetype
, bndrng
[1]);
1221 /* Try to verify that the sizes and lengths of the arguments to a string
1222 manipulation function given by EXP are within valid bounds and that
1223 the operation does not lead to buffer overflow or read past the end.
1224 Arguments other than EXP may be null. When non-null, the arguments
1225 have the following meaning:
1226 DST is the destination of a copy call or NULL otherwise.
1227 SRC is the source of a copy call or NULL otherwise.
1228 DSTWRITE is the number of bytes written into the destination obtained
1229 from the user-supplied size argument to the function (such as in
1230 memcpy(DST, SRCs, DSTWRITE) or strncpy(DST, DRC, DSTWRITE).
1231 MAXREAD is the user-supplied bound on the length of the source sequence
1232 (such as in strncat(d, s, N). It specifies the upper limit on the number
1233 of bytes to write. If NULL, it's taken to be the same as DSTWRITE.
1234 SRCSTR is the source string (such as in strcpy(DST, SRC)) when the
1235 expression EXP is a string function call (as opposed to a memory call
1236 like memcpy). As an exception, SRCSTR can also be an integer denoting
1237 the precomputed size of the source string or object (for functions like
1239 DSTSIZE is the size of the destination object.
1241 When DSTWRITE is null LEN is checked to verify that it doesn't exceed
1244 WRITE is true for write accesses, READ is true for reads. Both are
1245 false for simple size checks in calls to functions that neither read
1246 from nor write to the region.
1248 When nonnull, PAD points to a more detailed description of the access.
1250 If the call is successfully verified as safe return true, otherwise
1253 template <class GimpleOrTree
>
1255 check_access (GimpleOrTree exp
, tree dstwrite
,
1256 tree maxread
, tree srcstr
, tree dstsize
,
1257 access_mode mode
, const access_data
*pad
,
1260 /* The size of the largest object is half the address space, or
1261 PTRDIFF_MAX. (This is way too permissive.) */
1262 tree maxobjsize
= max_object_size ();
1264 /* Either an approximate/minimum the length of the source string for
1265 string functions or the size of the source object for raw memory
1267 tree slen
= NULL_TREE
;
1269 /* The range of the access in bytes; first set to the write access
1270 for functions that write and then read for those that also (or
1272 tree range
[2] = { NULL_TREE
, NULL_TREE
};
1274 /* Set to true when the exact number of bytes written by a string
1275 function like strcpy is not known and the only thing that is
1276 known is that it must be at least one (for the terminating nul). */
1277 bool at_least_one
= false;
1280 /* SRCSTR is normally a pointer to string but as a special case
1281 it can be an integer denoting the length of a string. */
1282 if (POINTER_TYPE_P (TREE_TYPE (srcstr
)))
1284 if (!check_nul_terminated_array (exp
, srcstr
, maxread
))
1285 /* Return if the array is not nul-terminated and a warning
1289 /* Try to determine the range of lengths the source string
1290 refers to. If it can be determined and is less than
1291 the upper bound given by MAXREAD add one to it for
1292 the terminating nul. Otherwise, set it to one for
1293 the same reason, or to MAXREAD as appropriate. */
1294 c_strlen_data lendata
= { };
1295 get_range_strlen (srcstr
, &lendata
, /* eltsize = */ 1);
1296 range
[0] = lendata
.minlen
;
1297 range
[1] = lendata
.maxbound
? lendata
.maxbound
: lendata
.maxlen
;
1299 && TREE_CODE (range
[0]) == INTEGER_CST
1300 && TREE_CODE (range
[1]) == INTEGER_CST
1301 && (!maxread
|| TREE_CODE (maxread
) == INTEGER_CST
))
1303 if (maxread
&& tree_int_cst_le (maxread
, range
[0]))
1304 range
[0] = range
[1] = maxread
;
1306 range
[0] = fold_build2 (PLUS_EXPR
, size_type_node
,
1307 range
[0], size_one_node
);
1309 if (maxread
&& tree_int_cst_le (maxread
, range
[1]))
1311 else if (!integer_all_onesp (range
[1]))
1312 range
[1] = fold_build2 (PLUS_EXPR
, size_type_node
,
1313 range
[1], size_one_node
);
1319 at_least_one
= true;
1320 slen
= size_one_node
;
1327 if (!dstwrite
&& !maxread
)
1329 /* When the only available piece of data is the object size
1330 there is nothing to do. */
1334 /* Otherwise, when the length of the source sequence is known
1335 (as with strlen), set DSTWRITE to it. */
1341 dstsize
= maxobjsize
;
1343 /* Set RANGE to that of DSTWRITE if non-null, bounded by PAD->DST_BNDRNG
1345 gimple
*stmt
= pad
? pad
->stmt
: nullptr;
1346 get_size_range (rvals
, dstwrite
, stmt
, range
, pad
? pad
->dst_bndrng
: NULL
);
1348 tree func
= get_callee_fndecl (exp
);
1349 /* Read vs write access by built-ins can be determined from the const
1350 qualifiers on the pointer argument. In the absence of attribute
1351 access, non-const qualified pointer arguments to user-defined
1352 functions are assumed to both read and write the objects. */
1353 const bool builtin
= func
? fndecl_built_in_p (func
) : false;
1355 /* First check the number of bytes to be written against the maximum
1358 && TREE_CODE (range
[0]) == INTEGER_CST
1359 && tree_int_cst_lt (maxobjsize
, range
[0]))
1361 location_t loc
= get_location (exp
);
1362 maybe_warn_for_bound (OPT_Wstringop_overflow_
, loc
, exp
, func
, range
,
1367 /* The number of bytes to write is "exact" if DSTWRITE is non-null,
1368 constant, and in range of unsigned HOST_WIDE_INT. */
1369 bool exactwrite
= dstwrite
&& tree_fits_uhwi_p (dstwrite
);
1371 /* Next check the number of bytes to be written against the destination
1373 if (range
[0] || !exactwrite
|| integer_all_onesp (dstwrite
))
1376 && TREE_CODE (range
[0]) == INTEGER_CST
1377 && ((tree_fits_uhwi_p (dstsize
)
1378 && tree_int_cst_lt (dstsize
, range
[0]))
1380 && tree_fits_uhwi_p (dstwrite
)
1381 && tree_int_cst_lt (dstwrite
, range
[0]))))
1383 const opt_code opt
= OPT_Wstringop_overflow_
;
1384 if (warning_suppressed_p (exp
, opt
)
1385 || (pad
&& pad
->dst
.ref
1386 && warning_suppressed_p (pad
->dst
.ref
, opt
)))
1389 location_t loc
= get_location (exp
);
1390 bool warned
= false;
1391 if (dstwrite
== slen
&& at_least_one
)
1393 /* This is a call to strcpy with a destination of 0 size
1394 and a source of unknown length. The call will write
1395 at least one byte past the end of the destination. */
1397 ? warning_at (loc
, opt
,
1398 "%qD writing %E or more bytes into "
1399 "a region of size %E overflows "
1401 func
, range
[0], dstsize
)
1402 : warning_at (loc
, opt
,
1403 "writing %E or more bytes into "
1404 "a region of size %E overflows "
1406 range
[0], dstsize
));
1411 = mode
== access_read_only
|| mode
== access_read_write
;
1413 = mode
== access_write_only
|| mode
== access_read_write
;
1414 const bool maybe
= pad
&& pad
->dst
.parmarray
;
1415 warned
= warn_for_access (loc
, func
, exp
,
1416 OPT_Wstringop_overflow_
,
1418 write
, read
&& !builtin
, maybe
);
1423 suppress_warning (exp
, OPT_Wstringop_overflow_
);
1425 pad
->dst
.inform_access (pad
->mode
);
1428 /* Return error when an overflow has been detected. */
1433 /* Check the maximum length of the source sequence against the size
1434 of the destination object if known, or against the maximum size
1438 /* Set RANGE to that of MAXREAD, bounded by PAD->SRC_BNDRNG if
1439 PAD is nonnull and BNDRNG is valid. */
1440 get_size_range (rvals
, maxread
, stmt
, range
, pad
? pad
->src_bndrng
: NULL
);
1442 location_t loc
= get_location (exp
);
1443 tree size
= dstsize
;
1444 if (pad
&& pad
->mode
== access_read_only
)
1445 size
= wide_int_to_tree (sizetype
, pad
->src
.size_remaining ());
1447 if (range
[0] && maxread
&& tree_fits_uhwi_p (size
))
1449 if (tree_int_cst_lt (maxobjsize
, range
[0]))
1451 maybe_warn_for_bound (OPT_Wstringop_overread
, loc
, exp
, func
,
1456 if (size
!= maxobjsize
&& tree_int_cst_lt (size
, range
[0]))
1458 opt_code opt
= (dstwrite
|| mode
!= access_read_only
1459 ? OPT_Wstringop_overflow_
1460 : OPT_Wstringop_overread
);
1461 maybe_warn_for_bound (opt
, loc
, exp
, func
, range
, size
, pad
);
1466 maybe_warn_nonstring_arg (func
, exp
);
1469 /* Check for reading past the end of SRC. */
1470 bool overread
= (slen
1474 && TREE_CODE (slen
) == INTEGER_CST
1475 && tree_int_cst_lt (slen
, range
[0]));
1476 /* If none is determined try to get a better answer based on the details
1480 && pad
->src
.sizrng
[1] >= 0
1481 && pad
->src
.offrng
[0] >= 0
1482 && (pad
->src
.offrng
[1] < 0
1483 || pad
->src
.offrng
[0] <= pad
->src
.offrng
[1]))
1485 /* Set RANGE to that of MAXREAD, bounded by PAD->SRC_BNDRNG if
1486 PAD is nonnull and BNDRNG is valid. */
1487 get_size_range (rvals
, maxread
, stmt
, range
, pad
? pad
->src_bndrng
: NULL
);
1488 /* Set OVERREAD for reads starting just past the end of an object. */
1489 overread
= pad
->src
.sizrng
[1] - pad
->src
.offrng
[0] < pad
->src_bndrng
[0];
1490 range
[0] = wide_int_to_tree (sizetype
, pad
->src_bndrng
[0]);
1491 slen
= size_zero_node
;
1496 const opt_code opt
= OPT_Wstringop_overread
;
1497 if (warning_suppressed_p (exp
, opt
)
1498 || (srcstr
&& warning_suppressed_p (srcstr
, opt
))
1499 || (pad
&& pad
->src
.ref
1500 && warning_suppressed_p (pad
->src
.ref
, opt
)))
1503 location_t loc
= get_location (exp
);
1505 = mode
== access_read_only
|| mode
== access_read_write
;
1506 const bool maybe
= pad
&& pad
->dst
.parmarray
;
1507 if (warn_for_access (loc
, func
, exp
, opt
, range
, slen
, false, read
,
1510 suppress_warning (exp
, opt
);
1512 pad
->src
.inform_access (access_read_only
);
1521 check_access (gimple
*stmt
, tree dstwrite
,
1522 tree maxread
, tree srcstr
, tree dstsize
,
1523 access_mode mode
, const access_data
*pad
,
1526 return check_access
<gimple
*> (stmt
, dstwrite
, maxread
, srcstr
, dstsize
,
1531 check_access (tree expr
, tree dstwrite
,
1532 tree maxread
, tree srcstr
, tree dstsize
,
1533 access_mode mode
, const access_data
*pad
/* = NULL */)
1535 return check_access
<tree
> (expr
, dstwrite
, maxread
, srcstr
, dstsize
,
1536 mode
, pad
, nullptr);
1539 /* Return true if STMT is a call to an allocation function. Unless
1540 ALL_ALLOC is set, consider only functions that return dynmamically
1541 allocated objects. Otherwise return true even for all forms of
1542 alloca (including VLA). */
1545 fndecl_alloc_p (tree fndecl
, bool all_alloc
)
1550 /* A call to operator new isn't recognized as one to a built-in. */
1551 if (DECL_IS_OPERATOR_NEW_P (fndecl
))
1554 if (fndecl_built_in_p (fndecl
, BUILT_IN_NORMAL
))
1556 switch (DECL_FUNCTION_CODE (fndecl
))
1558 case BUILT_IN_ALLOCA
:
1559 case BUILT_IN_ALLOCA_WITH_ALIGN
:
1561 case BUILT_IN_ALIGNED_ALLOC
:
1562 case BUILT_IN_CALLOC
:
1563 case BUILT_IN_GOMP_ALLOC
:
1564 case BUILT_IN_MALLOC
:
1565 case BUILT_IN_REALLOC
:
1566 case BUILT_IN_STRDUP
:
1567 case BUILT_IN_STRNDUP
:
1574 /* A function is considered an allocation function if it's declared
1575 with attribute malloc with an argument naming its associated
1576 deallocation function. */
1577 tree attrs
= DECL_ATTRIBUTES (fndecl
);
1581 for (tree allocs
= attrs
;
1582 (allocs
= lookup_attribute ("malloc", allocs
));
1583 allocs
= TREE_CHAIN (allocs
))
1585 tree args
= TREE_VALUE (allocs
);
1589 if (TREE_VALUE (args
))
1596 /* Return true if STMT is a call to an allocation function. A wrapper
1597 around fndecl_alloc_p. */
1600 gimple_call_alloc_p (gimple
*stmt
, bool all_alloc
= false)
1602 return fndecl_alloc_p (gimple_call_fndecl (stmt
), all_alloc
);
1605 /* Return true if DELC doesn't refer to an operator delete that's
1606 suitable to call with a pointer returned from the operator new
1607 described by NEWC. */
1610 new_delete_mismatch_p (const demangle_component
&newc
,
1611 const demangle_component
&delc
)
1613 if (newc
.type
!= delc
.type
)
1618 case DEMANGLE_COMPONENT_NAME
:
1620 int len
= newc
.u
.s_name
.len
;
1621 const char *news
= newc
.u
.s_name
.s
;
1622 const char *dels
= delc
.u
.s_name
.s
;
1623 if (len
!= delc
.u
.s_name
.len
|| memcmp (news
, dels
, len
))
1626 if (news
[len
] == 'n')
1628 if (news
[len
+ 1] == 'a')
1629 return dels
[len
] != 'd' || dels
[len
+ 1] != 'a';
1630 if (news
[len
+ 1] == 'w')
1631 return dels
[len
] != 'd' || dels
[len
+ 1] != 'l';
1636 case DEMANGLE_COMPONENT_OPERATOR
:
1637 /* Operator mismatches are handled above. */
1640 case DEMANGLE_COMPONENT_EXTENDED_OPERATOR
:
1641 if (newc
.u
.s_extended_operator
.args
!= delc
.u
.s_extended_operator
.args
)
1643 return new_delete_mismatch_p (*newc
.u
.s_extended_operator
.name
,
1644 *delc
.u
.s_extended_operator
.name
);
1646 case DEMANGLE_COMPONENT_FIXED_TYPE
:
1647 if (newc
.u
.s_fixed
.accum
!= delc
.u
.s_fixed
.accum
1648 || newc
.u
.s_fixed
.sat
!= delc
.u
.s_fixed
.sat
)
1650 return new_delete_mismatch_p (*newc
.u
.s_fixed
.length
,
1651 *delc
.u
.s_fixed
.length
);
1653 case DEMANGLE_COMPONENT_CTOR
:
1654 if (newc
.u
.s_ctor
.kind
!= delc
.u
.s_ctor
.kind
)
1656 return new_delete_mismatch_p (*newc
.u
.s_ctor
.name
,
1657 *delc
.u
.s_ctor
.name
);
1659 case DEMANGLE_COMPONENT_DTOR
:
1660 if (newc
.u
.s_dtor
.kind
!= delc
.u
.s_dtor
.kind
)
1662 return new_delete_mismatch_p (*newc
.u
.s_dtor
.name
,
1663 *delc
.u
.s_dtor
.name
);
1665 case DEMANGLE_COMPONENT_BUILTIN_TYPE
:
1667 /* The demangler API provides no better way to compare built-in
1668 types except to by comparing their demangled names. */
1670 demangle_component
*pnc
= const_cast<demangle_component
*>(&newc
);
1671 demangle_component
*pdc
= const_cast<demangle_component
*>(&delc
);
1672 char *nts
= cplus_demangle_print (0, pnc
, 16, &nsz
);
1673 char *dts
= cplus_demangle_print (0, pdc
, 16, &dsz
);
1676 bool mismatch
= strcmp (nts
, dts
);
1682 case DEMANGLE_COMPONENT_SUB_STD
:
1683 if (newc
.u
.s_string
.len
!= delc
.u
.s_string
.len
)
1685 return memcmp (newc
.u
.s_string
.string
, delc
.u
.s_string
.string
,
1686 newc
.u
.s_string
.len
);
1688 case DEMANGLE_COMPONENT_FUNCTION_PARAM
:
1689 case DEMANGLE_COMPONENT_TEMPLATE_PARAM
:
1690 return newc
.u
.s_number
.number
!= delc
.u
.s_number
.number
;
1692 case DEMANGLE_COMPONENT_CHARACTER
:
1693 return newc
.u
.s_character
.character
!= delc
.u
.s_character
.character
;
1695 case DEMANGLE_COMPONENT_DEFAULT_ARG
:
1696 case DEMANGLE_COMPONENT_LAMBDA
:
1697 if (newc
.u
.s_unary_num
.num
!= delc
.u
.s_unary_num
.num
)
1699 return new_delete_mismatch_p (*newc
.u
.s_unary_num
.sub
,
1700 *delc
.u
.s_unary_num
.sub
);
1705 if (!newc
.u
.s_binary
.left
!= !delc
.u
.s_binary
.left
)
1708 if (!newc
.u
.s_binary
.left
)
1711 if (new_delete_mismatch_p (*newc
.u
.s_binary
.left
, *delc
.u
.s_binary
.left
)
1712 || !newc
.u
.s_binary
.right
!= !delc
.u
.s_binary
.right
)
1715 if (newc
.u
.s_binary
.right
)
1716 return new_delete_mismatch_p (*newc
.u
.s_binary
.right
,
1717 *delc
.u
.s_binary
.right
);
1721 /* Return true if DELETE_DECL is an operator delete that's not suitable
1722 to call with a pointer returned fron NEW_DECL. */
1725 new_delete_mismatch_p (tree new_decl
, tree delete_decl
)
1727 tree new_name
= DECL_ASSEMBLER_NAME (new_decl
);
1728 tree delete_name
= DECL_ASSEMBLER_NAME (delete_decl
);
1730 /* valid_new_delete_pair_p() returns a conservative result (currently
1731 it only handles global operators). A true result is reliable but
1732 a false result doesn't necessarily mean the operators don't match
1733 unless CERTAIN is set. */
1735 if (valid_new_delete_pair_p (new_name
, delete_name
, &certain
))
1737 /* CERTAIN is set when the negative result is certain. */
1741 /* For anything not handled by valid_new_delete_pair_p() such as member
1742 operators compare the individual demangled components of the mangled
1744 const char *new_str
= IDENTIFIER_POINTER (new_name
);
1745 const char *del_str
= IDENTIFIER_POINTER (delete_name
);
1747 void *np
= NULL
, *dp
= NULL
;
1748 demangle_component
*ndc
= cplus_demangle_v3_components (new_str
, 0, &np
);
1749 demangle_component
*ddc
= cplus_demangle_v3_components (del_str
, 0, &dp
);
1750 bool mismatch
= new_delete_mismatch_p (*ndc
, *ddc
);
1756 /* ALLOC_DECL and DEALLOC_DECL are pair of allocation and deallocation
1757 functions. Return true if the latter is suitable to deallocate objects
1758 allocated by calls to the former. */
1761 matching_alloc_calls_p (tree alloc_decl
, tree dealloc_decl
)
1763 /* Set to alloc_kind_t::builtin if ALLOC_DECL is associated with
1764 a built-in deallocator. */
1765 enum class alloc_kind_t
{ none
, builtin
, user
}
1766 alloc_dealloc_kind
= alloc_kind_t::none
;
1768 if (DECL_IS_OPERATOR_NEW_P (alloc_decl
))
1770 if (DECL_IS_OPERATOR_DELETE_P (dealloc_decl
))
1771 /* Return true iff both functions are of the same array or
1772 singleton form and false otherwise. */
1773 return !new_delete_mismatch_p (alloc_decl
, dealloc_decl
);
1775 /* Return false for deallocation functions that are known not
1777 if (fndecl_built_in_p (dealloc_decl
, BUILT_IN_FREE
)
1778 || fndecl_built_in_p (dealloc_decl
, BUILT_IN_REALLOC
))
1780 /* Otherwise proceed below to check the deallocation function's
1781 "*dealloc" attributes to look for one that mentions this operator
1784 else if (fndecl_built_in_p (alloc_decl
, BUILT_IN_NORMAL
))
1786 switch (DECL_FUNCTION_CODE (alloc_decl
))
1788 case BUILT_IN_ALLOCA
:
1789 case BUILT_IN_ALLOCA_WITH_ALIGN
:
1792 case BUILT_IN_ALIGNED_ALLOC
:
1793 case BUILT_IN_CALLOC
:
1794 case BUILT_IN_GOMP_ALLOC
:
1795 case BUILT_IN_MALLOC
:
1796 case BUILT_IN_REALLOC
:
1797 case BUILT_IN_STRDUP
:
1798 case BUILT_IN_STRNDUP
:
1799 if (DECL_IS_OPERATOR_DELETE_P (dealloc_decl
))
1802 if (fndecl_built_in_p (dealloc_decl
, BUILT_IN_FREE
)
1803 || fndecl_built_in_p (dealloc_decl
, BUILT_IN_REALLOC
))
1806 alloc_dealloc_kind
= alloc_kind_t::builtin
;
1814 /* Set if DEALLOC_DECL both allocates and deallocates. */
1815 alloc_kind_t realloc_kind
= alloc_kind_t::none
;
1817 if (fndecl_built_in_p (dealloc_decl
, BUILT_IN_NORMAL
))
1819 built_in_function dealloc_code
= DECL_FUNCTION_CODE (dealloc_decl
);
1820 if (dealloc_code
== BUILT_IN_REALLOC
)
1821 realloc_kind
= alloc_kind_t::builtin
;
1823 for (tree amats
= DECL_ATTRIBUTES (alloc_decl
);
1824 (amats
= lookup_attribute ("malloc", amats
));
1825 amats
= TREE_CHAIN (amats
))
1827 tree args
= TREE_VALUE (amats
);
1831 tree fndecl
= TREE_VALUE (args
);
1832 if (!fndecl
|| !DECL_P (fndecl
))
1835 if (fndecl_built_in_p (fndecl
, BUILT_IN_NORMAL
)
1836 && dealloc_code
== DECL_FUNCTION_CODE (fndecl
))
1841 const bool alloc_builtin
= fndecl_built_in_p (alloc_decl
, BUILT_IN_NORMAL
);
1842 alloc_kind_t realloc_dealloc_kind
= alloc_kind_t::none
;
1844 /* If DEALLOC_DECL has an internal "*dealloc" attribute scan the list
1845 of its associated allocation functions for ALLOC_DECL.
1846 If the corresponding ALLOC_DECL is found they're a matching pair,
1847 otherwise they're not.
1848 With DDATS set to the Deallocator's *Dealloc ATtributes... */
1849 for (tree ddats
= DECL_ATTRIBUTES (dealloc_decl
);
1850 (ddats
= lookup_attribute ("*dealloc", ddats
));
1851 ddats
= TREE_CHAIN (ddats
))
1853 tree args
= TREE_VALUE (ddats
);
1857 tree alloc
= TREE_VALUE (args
);
1861 if (alloc
== DECL_NAME (dealloc_decl
))
1862 realloc_kind
= alloc_kind_t::user
;
1866 gcc_checking_assert (fndecl_built_in_p (alloc
, BUILT_IN_NORMAL
));
1868 switch (DECL_FUNCTION_CODE (alloc
))
1870 case BUILT_IN_ALIGNED_ALLOC
:
1871 case BUILT_IN_CALLOC
:
1872 case BUILT_IN_GOMP_ALLOC
:
1873 case BUILT_IN_MALLOC
:
1874 case BUILT_IN_REALLOC
:
1875 case BUILT_IN_STRDUP
:
1876 case BUILT_IN_STRNDUP
:
1877 realloc_dealloc_kind
= alloc_kind_t::builtin
;
1886 if (DECL_FUNCTION_CODE (alloc
) != DECL_FUNCTION_CODE (alloc_decl
))
1892 if (alloc
== DECL_NAME (alloc_decl
))
1896 if (realloc_kind
== alloc_kind_t::none
)
1899 hash_set
<tree
> common_deallocs
;
1900 /* Special handling for deallocators. Iterate over both the allocator's
1901 and the reallocator's associated deallocator functions looking for
1902 the first one in common. If one is found, the de/reallocator is
1903 a match for the allocator even though the latter isn't directly
1904 associated with the former. This simplifies declarations in system
1906 With AMATS set to the Allocator's Malloc ATtributes,
1907 and RMATS set to Reallocator's Malloc ATtributes... */
1908 for (tree amats
= DECL_ATTRIBUTES (alloc_decl
),
1909 rmats
= DECL_ATTRIBUTES (dealloc_decl
);
1910 (amats
= lookup_attribute ("malloc", amats
))
1911 || (rmats
= lookup_attribute ("malloc", rmats
));
1912 amats
= amats
? TREE_CHAIN (amats
) : NULL_TREE
,
1913 rmats
= rmats
? TREE_CHAIN (rmats
) : NULL_TREE
)
1915 if (tree args
= amats
? TREE_VALUE (amats
) : NULL_TREE
)
1916 if (tree adealloc
= TREE_VALUE (args
))
1918 if (DECL_P (adealloc
)
1919 && fndecl_built_in_p (adealloc
, BUILT_IN_NORMAL
))
1921 built_in_function fncode
= DECL_FUNCTION_CODE (adealloc
);
1922 if (fncode
== BUILT_IN_FREE
|| fncode
== BUILT_IN_REALLOC
)
1924 if (realloc_kind
== alloc_kind_t::builtin
)
1926 alloc_dealloc_kind
= alloc_kind_t::builtin
;
1931 common_deallocs
.add (adealloc
);
1934 if (tree args
= rmats
? TREE_VALUE (rmats
) : NULL_TREE
)
1935 if (tree ddealloc
= TREE_VALUE (args
))
1937 if (DECL_P (ddealloc
)
1938 && fndecl_built_in_p (ddealloc
, BUILT_IN_NORMAL
))
1940 built_in_function fncode
= DECL_FUNCTION_CODE (ddealloc
);
1941 if (fncode
== BUILT_IN_FREE
|| fncode
== BUILT_IN_REALLOC
)
1943 if (alloc_dealloc_kind
== alloc_kind_t::builtin
)
1945 realloc_dealloc_kind
= alloc_kind_t::builtin
;
1950 if (common_deallocs
.add (ddealloc
))
1955 /* Succeed only if ALLOC_DECL and the reallocator DEALLOC_DECL share
1956 a built-in deallocator. */
1957 return (alloc_dealloc_kind
== alloc_kind_t::builtin
1958 && realloc_dealloc_kind
== alloc_kind_t::builtin
);
1961 /* Return true if DEALLOC_DECL is a function suitable to deallocate
1962 objectes allocated by the ALLOC call. */
1965 matching_alloc_calls_p (gimple
*alloc
, tree dealloc_decl
)
1967 tree alloc_decl
= gimple_call_fndecl (alloc
);
1971 return matching_alloc_calls_p (alloc_decl
, dealloc_decl
);
1974 /* Diagnose a call EXP to deallocate a pointer referenced by AREF if it
1975 includes a nonzero offset. Such a pointer cannot refer to the beginning
1976 of an allocated object. A negative offset may refer to it only if
1977 the target pointer is unknown. */
1980 warn_dealloc_offset (location_t loc
, gimple
*call
, const access_ref
&aref
)
1982 if (aref
.deref
|| aref
.offrng
[0] <= 0 || aref
.offrng
[1] <= 0)
1985 tree dealloc_decl
= gimple_call_fndecl (call
);
1989 if (DECL_IS_OPERATOR_DELETE_P (dealloc_decl
)
1990 && !DECL_IS_REPLACEABLE_OPERATOR (dealloc_decl
))
1992 /* A call to a user-defined operator delete with a pointer plus offset
1993 may be valid if it's returned from an unknown function (i.e., one
1994 that's not operator new). */
1995 if (TREE_CODE (aref
.ref
) == SSA_NAME
)
1997 gimple
*def_stmt
= SSA_NAME_DEF_STMT (aref
.ref
);
1998 if (is_gimple_call (def_stmt
))
2000 tree alloc_decl
= gimple_call_fndecl (def_stmt
);
2001 if (!alloc_decl
|| !DECL_IS_OPERATOR_NEW_P (alloc_decl
))
2009 if (wi::fits_shwi_p (aref
.offrng
[0]))
2011 if (aref
.offrng
[0] == aref
.offrng
[1]
2012 || !wi::fits_shwi_p (aref
.offrng
[1]))
2013 sprintf (offstr
, " %lli",
2014 (long long)aref
.offrng
[0].to_shwi ());
2016 sprintf (offstr
, " [%lli, %lli]",
2017 (long long)aref
.offrng
[0].to_shwi (),
2018 (long long)aref
.offrng
[1].to_shwi ());
2021 if (!warning_at (loc
, OPT_Wfree_nonheap_object
,
2022 "%qD called on pointer %qE with nonzero offset%s",
2023 dealloc_decl
, aref
.ref
, offstr
))
2026 if (DECL_P (aref
.ref
))
2027 inform (get_location (aref
.ref
), "declared here");
2028 else if (TREE_CODE (aref
.ref
) == SSA_NAME
)
2030 gimple
*def_stmt
= SSA_NAME_DEF_STMT (aref
.ref
);
2031 if (is_gimple_call (def_stmt
))
2033 location_t def_loc
= get_location (def_stmt
);
2034 tree alloc_decl
= gimple_call_fndecl (def_stmt
);
2037 "returned from %qD", alloc_decl
);
2038 else if (tree alloc_fntype
= gimple_call_fntype (def_stmt
))
2040 "returned from %qT", alloc_fntype
);
2042 inform (def_loc
, "obtained here");
2051 const pass_data pass_data_waccess
= {
2056 PROP_cfg
, /* properties_required */
2057 0, /* properties_provided */
2058 0, /* properties_destroyed */
2059 0, /* properties_start */
2060 0, /* properties_finish */
2063 /* Pass to detect invalid accesses. */
2064 class pass_waccess
: public gimple_opt_pass
2067 pass_waccess (gcc::context
*);
2071 opt_pass
*clone () { return new pass_waccess (m_ctxt
); }
2073 virtual bool gate (function
*);
2074 virtual unsigned int execute (function
*);
2077 /* Not copyable or assignable. */
2078 pass_waccess (pass_waccess
&) = delete;
2079 void operator= (pass_waccess
&) = delete;
2081 /* Check a call to an atomic built-in function. */
2082 bool check_atomic_builtin (gcall
*);
2084 /* Check a call to a built-in function. */
2085 bool check_builtin (gcall
*);
2087 /* Check a call to an ordinary function. */
2088 bool check_call (gcall
*);
2090 /* Check statements in a basic block. */
2091 void check (basic_block
);
2093 /* Check a call to a function. */
2094 void check (gcall
*);
2096 /* Check a call to the named built-in function. */
2097 void check_alloca (gcall
*);
2098 void check_alloc_size_call (gcall
*);
2099 void check_strcat (gcall
*);
2100 void check_strncat (gcall
*);
2101 void check_stxcpy (gcall
*);
2102 void check_stxncpy (gcall
*);
2103 void check_strncmp (gcall
*);
2104 void check_memop_access (gimple
*, tree
, tree
, tree
);
2105 void check_read_access (gimple
*, tree
, tree
= NULL_TREE
, int = 1);
2107 void maybe_check_dealloc_call (gcall
*);
2108 void maybe_check_access_sizes (rdwr_map
*, tree
, tree
, gimple
*);
2109 bool maybe_warn_memmodel (gimple
*, tree
, tree
, const unsigned char *);
2110 void check_atomic_memmodel (gimple
*, tree
, tree
, const unsigned char *);
2112 /* A pointer_query object and its cache to store information about
2113 pointers and their targets in. */
2114 pointer_query m_ptr_qry
;
2115 pointer_query::cache_type m_var_cache
;
2118 /* Construct the pass. */
2120 pass_waccess::pass_waccess (gcc::context
*ctxt
)
2121 : gimple_opt_pass (pass_data_waccess
, ctxt
),
2122 m_ptr_qry (NULL
, &m_var_cache
),
2127 /* Release pointer_query cache. */
2129 pass_waccess::~pass_waccess ()
2131 m_ptr_qry
.flush_cache ();
2134 /* Return true when any checks performed by the pass are enabled. */
2137 pass_waccess::gate (function
*)
2139 return (warn_free_nonheap_object
2140 || warn_mismatched_alloc
2141 || warn_mismatched_new_delete
);
2144 /* Initialize ALLOC_OBJECT_SIZE_LIMIT based on the -Walloc-size-larger-than=
2145 setting if the option is specified, or to the maximum object size if it
2146 is not. Return the initialized value. */
2149 alloc_max_size (void)
2151 HOST_WIDE_INT limit
= warn_alloc_size_limit
;
2152 if (limit
== HOST_WIDE_INT_MAX
)
2153 limit
= tree_to_shwi (TYPE_MAX_VALUE (ptrdiff_type_node
));
2155 return build_int_cst (size_type_node
, limit
);
2158 /* Diagnose a call EXP to function FN decorated with attribute alloc_size
2159 whose argument numbers given by IDX with values given by ARGS exceed
2160 the maximum object size or cause an unsigned oveflow (wrapping) when
2161 multiplied. FN is null when EXP is a call via a function pointer.
2162 When ARGS[0] is null the function does nothing. ARGS[1] may be null
2163 for functions like malloc, and non-null for those like calloc that
2164 are decorated with a two-argument attribute alloc_size. */
2167 maybe_warn_alloc_args_overflow (gimple
*stmt
, const tree args
[2],
2170 /* The range each of the (up to) two arguments is known to be in. */
2171 tree argrange
[2][2] = { { NULL_TREE
, NULL_TREE
}, { NULL_TREE
, NULL_TREE
} };
2173 /* Maximum object size set by -Walloc-size-larger-than= or SIZE_MAX / 2. */
2174 tree maxobjsize
= alloc_max_size ();
2176 location_t loc
= get_location (stmt
);
2178 tree fn
= gimple_call_fndecl (stmt
);
2179 tree fntype
= fn
? TREE_TYPE (fn
) : gimple_call_fntype (stmt
);
2180 bool warned
= false;
2182 /* Validate each argument individually. */
2183 for (unsigned i
= 0; i
!= 2 && args
[i
]; ++i
)
2185 if (TREE_CODE (args
[i
]) == INTEGER_CST
)
2187 argrange
[i
][0] = args
[i
];
2188 argrange
[i
][1] = args
[i
];
2190 if (tree_int_cst_lt (args
[i
], integer_zero_node
))
2192 warned
= warning_at (loc
, OPT_Walloc_size_larger_than_
,
2193 "argument %i value %qE is negative",
2194 idx
[i
] + 1, args
[i
]);
2196 else if (integer_zerop (args
[i
]))
2198 /* Avoid issuing -Walloc-zero for allocation functions other
2199 than __builtin_alloca that are declared with attribute
2200 returns_nonnull because there's no portability risk. This
2201 avoids warning for such calls to libiberty's xmalloc and
2203 Also avoid issuing the warning for calls to function named
2205 if (fn
&& fndecl_built_in_p (fn
, BUILT_IN_ALLOCA
)
2206 ? IDENTIFIER_LENGTH (DECL_NAME (fn
)) != 6
2207 : !lookup_attribute ("returns_nonnull",
2208 TYPE_ATTRIBUTES (fntype
)))
2209 warned
= warning_at (loc
, OPT_Walloc_zero
,
2210 "argument %i value is zero",
2213 else if (tree_int_cst_lt (maxobjsize
, args
[i
]))
2215 /* G++ emits calls to ::operator new[](SIZE_MAX) in C++98
2216 mode and with -fno-exceptions as a way to indicate array
2217 size overflow. There's no good way to detect C++98 here
2218 so avoid diagnosing these calls for all C++ modes. */
2223 && DECL_IS_OPERATOR_NEW_P (fn
)
2224 && integer_all_onesp (args
[i
]))
2227 warned
= warning_at (loc
, OPT_Walloc_size_larger_than_
,
2228 "argument %i value %qE exceeds "
2229 "maximum object size %E",
2230 idx
[i
] + 1, args
[i
], maxobjsize
);
2233 else if (TREE_CODE (args
[i
]) == SSA_NAME
2234 && get_size_range (args
[i
], argrange
[i
]))
2236 /* Verify that the argument's range is not negative (including
2237 upper bound of zero). */
2238 if (tree_int_cst_lt (argrange
[i
][0], integer_zero_node
)
2239 && tree_int_cst_le (argrange
[i
][1], integer_zero_node
))
2241 warned
= warning_at (loc
, OPT_Walloc_size_larger_than_
,
2242 "argument %i range [%E, %E] is negative",
2244 argrange
[i
][0], argrange
[i
][1]);
2246 else if (tree_int_cst_lt (maxobjsize
, argrange
[i
][0]))
2248 warned
= warning_at (loc
, OPT_Walloc_size_larger_than_
,
2249 "argument %i range [%E, %E] exceeds "
2250 "maximum object size %E",
2252 argrange
[i
][0], argrange
[i
][1],
2258 if (!argrange
[0][0])
2261 /* For a two-argument alloc_size, validate the product of the two
2262 arguments if both of their values or ranges are known. */
2263 if (!warned
&& tree_fits_uhwi_p (argrange
[0][0])
2264 && argrange
[1][0] && tree_fits_uhwi_p (argrange
[1][0])
2265 && !integer_onep (argrange
[0][0])
2266 && !integer_onep (argrange
[1][0]))
2268 /* Check for overflow in the product of a function decorated with
2269 attribute alloc_size (X, Y). */
2270 unsigned szprec
= TYPE_PRECISION (size_type_node
);
2271 wide_int x
= wi::to_wide (argrange
[0][0], szprec
);
2272 wide_int y
= wi::to_wide (argrange
[1][0], szprec
);
2274 wi::overflow_type vflow
;
2275 wide_int prod
= wi::umul (x
, y
, &vflow
);
2278 warned
= warning_at (loc
, OPT_Walloc_size_larger_than_
,
2279 "product %<%E * %E%> of arguments %i and %i "
2280 "exceeds %<SIZE_MAX%>",
2281 argrange
[0][0], argrange
[1][0],
2282 idx
[0] + 1, idx
[1] + 1);
2283 else if (wi::ltu_p (wi::to_wide (maxobjsize
, szprec
), prod
))
2284 warned
= warning_at (loc
, OPT_Walloc_size_larger_than_
,
2285 "product %<%E * %E%> of arguments %i and %i "
2286 "exceeds maximum object size %E",
2287 argrange
[0][0], argrange
[1][0],
2288 idx
[0] + 1, idx
[1] + 1,
2293 /* Print the full range of each of the two arguments to make
2294 it clear when it is, in fact, in a range and not constant. */
2295 if (argrange
[0][0] != argrange
[0][1])
2296 inform (loc
, "argument %i in the range [%E, %E]",
2297 idx
[0] + 1, argrange
[0][0], argrange
[0][1]);
2298 if (argrange
[1][0] != argrange
[1][1])
2299 inform (loc
, "argument %i in the range [%E, %E]",
2300 idx
[1] + 1, argrange
[1][0], argrange
[1][1]);
2306 location_t fnloc
= DECL_SOURCE_LOCATION (fn
);
2308 if (DECL_IS_UNDECLARED_BUILTIN (fn
))
2310 "in a call to built-in allocation function %qD", fn
);
2313 "in a call to allocation function %qD declared here", fn
);
2317 /* Check a call to an alloca function for an excessive size. */
2320 pass_waccess::check_alloca (gcall
*stmt
)
2322 if ((warn_vla_limit
>= HOST_WIDE_INT_MAX
2323 && warn_alloc_size_limit
< warn_vla_limit
)
2324 || (warn_alloca_limit
>= HOST_WIDE_INT_MAX
2325 && warn_alloc_size_limit
< warn_alloca_limit
))
2327 /* -Walloca-larger-than and -Wvla-larger-than settings of less
2328 than HWI_MAX override the more general -Walloc-size-larger-than
2329 so unless either of the former options is smaller than the last
2330 one (wchich would imply that the call was already checked), check
2331 the alloca arguments for overflow. */
2332 const tree alloc_args
[] = { call_arg (stmt
, 0), NULL_TREE
};
2333 const int idx
[] = { 0, -1 };
2334 maybe_warn_alloc_args_overflow (stmt
, alloc_args
, idx
);
2338 /* Check a call to an allocation function for an excessive size. */
2341 pass_waccess::check_alloc_size_call (gcall
*stmt
)
2343 tree fndecl
= gimple_call_fndecl (stmt
);
2344 if (fndecl
&& gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
))
2346 /* Alloca is handled separately. */
2347 switch (DECL_FUNCTION_CODE (fndecl
))
2349 case BUILT_IN_ALLOCA
:
2350 case BUILT_IN_ALLOCA_WITH_ALIGN
:
2351 case BUILT_IN_ALLOCA_WITH_ALIGN_AND_MAX
:
2358 tree fntype
= gimple_call_fntype (stmt
);
2359 tree fntypeattrs
= TYPE_ATTRIBUTES (fntype
);
2361 tree alloc_size
= lookup_attribute ("alloc_size", fntypeattrs
);
2365 /* Extract attribute alloc_size from the type of the called expression
2366 (which could be a function or a function pointer) and if set, store
2367 the indices of the corresponding arguments in ALLOC_IDX, and then
2368 the actual argument(s) at those indices in ALLOC_ARGS. */
2369 int idx
[2] = { -1, -1 };
2370 tree alloc_args
[] = { NULL_TREE
, NULL_TREE
};
2371 unsigned nargs
= gimple_call_num_args (stmt
);
2373 tree args
= TREE_VALUE (alloc_size
);
2374 idx
[0] = TREE_INT_CST_LOW (TREE_VALUE (args
)) - 1;
2375 /* Avoid invalid calls to functions without a prototype. */
2376 if ((unsigned) idx
[0] >= nargs
)
2378 alloc_args
[0] = call_arg (stmt
, idx
[0]);
2379 if (TREE_CHAIN (args
))
2381 idx
[1] = TREE_INT_CST_LOW (TREE_VALUE (TREE_CHAIN (args
))) - 1;
2382 if ((unsigned) idx
[1] >= nargs
)
2384 alloc_args
[1] = call_arg (stmt
, idx
[1]);
2387 maybe_warn_alloc_args_overflow (stmt
, alloc_args
, idx
);
2390 /* Check a call STMT to strcat() for overflow and warn if it does. */
2393 pass_waccess::check_strcat (gcall
*stmt
)
2395 if (!warn_stringop_overflow
&& !warn_stringop_overread
)
2398 tree dest
= call_arg (stmt
, 0);
2399 tree src
= call_arg (stmt
, 1);
2401 /* There is no way here to determine the length of the string in
2402 the destination to which the SRC string is being appended so
2403 just diagnose cases when the souce string is longer than
2404 the destination object. */
2405 access_data
data (m_ptr_qry
.rvals
, stmt
, access_read_write
, NULL_TREE
,
2406 true, NULL_TREE
, true);
2407 const int ost
= warn_stringop_overflow
? warn_stringop_overflow
- 1 : 1;
2408 compute_objsize (src
, stmt
, ost
, &data
.src
, &m_ptr_qry
);
2409 tree destsize
= compute_objsize (dest
, stmt
, ost
, &data
.dst
, &m_ptr_qry
);
2411 check_access (stmt
, /*dstwrite=*/NULL_TREE
, /*maxread=*/NULL_TREE
,
2412 src
, destsize
, data
.mode
, &data
, m_ptr_qry
.rvals
);
2415 /* Check a call STMT to strcat() for overflow and warn if it does. */
2418 pass_waccess::check_strncat (gcall
*stmt
)
2420 if (!warn_stringop_overflow
&& !warn_stringop_overread
)
2423 tree dest
= call_arg (stmt
, 0);
2424 tree src
= call_arg (stmt
, 1);
2425 /* The upper bound on the number of bytes to write. */
2426 tree maxread
= call_arg (stmt
, 2);
2428 /* Detect unterminated source (only). */
2429 if (!check_nul_terminated_array (stmt
, src
, maxread
))
2432 /* The length of the source sequence. */
2433 tree slen
= c_strlen (src
, 1);
2435 /* Try to determine the range of lengths that the source expression
2436 refers to. Since the lengths are only used for warning and not
2437 for code generation disable strict mode below. */
2441 c_strlen_data lendata
= { };
2442 get_range_strlen (src
, &lendata
, /* eltsize = */ 1);
2443 maxlen
= lendata
.maxbound
;
2446 access_data
data (m_ptr_qry
.rvals
, stmt
, access_read_write
);
2447 /* Try to verify that the destination is big enough for the shortest
2448 string. First try to determine the size of the destination object
2449 into which the source is being copied. */
2450 const int ost
= warn_stringop_overflow
- 1;
2451 tree destsize
= compute_objsize (dest
, stmt
, ost
, &data
.dst
, &m_ptr_qry
);
2453 /* Add one for the terminating nul. */
2454 tree srclen
= (maxlen
2455 ? fold_build2 (PLUS_EXPR
, size_type_node
, maxlen
,
2459 /* The strncat function copies at most MAXREAD bytes and always appends
2460 the terminating nul so the specified upper bound should never be equal
2461 to (or greater than) the size of the destination. */
2462 if (tree_fits_uhwi_p (maxread
) && tree_fits_uhwi_p (destsize
)
2463 && tree_int_cst_equal (destsize
, maxread
))
2465 location_t loc
= get_location (stmt
);
2466 warning_at (loc
, OPT_Wstringop_overflow_
,
2467 "%qD specified bound %E equals destination size",
2468 get_callee_fndecl (stmt
), maxread
);
2474 || (maxread
&& tree_fits_uhwi_p (maxread
)
2475 && tree_fits_uhwi_p (srclen
)
2476 && tree_int_cst_lt (maxread
, srclen
)))
2479 check_access (stmt
, /*dstwrite=*/NULL_TREE
, maxread
, srclen
,
2480 destsize
, data
.mode
, &data
, m_ptr_qry
.rvals
);
2483 /* Check a call STMT to stpcpy() or strcpy() for overflow and warn
2487 pass_waccess::check_stxcpy (gcall
*stmt
)
2489 tree dst
= call_arg (stmt
, 0);
2490 tree src
= call_arg (stmt
, 1);
2494 if (tree nonstr
= unterminated_array (src
, &size
, &exact
))
2496 /* NONSTR refers to the non-nul terminated constant array. */
2497 warn_string_no_nul (get_location (stmt
), stmt
, NULL
, src
, nonstr
,
2502 if (warn_stringop_overflow
)
2504 access_data
data (m_ptr_qry
.rvals
, stmt
, access_read_write
, NULL_TREE
,
2505 true, NULL_TREE
, true);
2506 const int ost
= warn_stringop_overflow
? warn_stringop_overflow
- 1 : 1;
2507 compute_objsize (src
, stmt
, ost
, &data
.src
, &m_ptr_qry
);
2508 tree dstsize
= compute_objsize (dst
, stmt
, ost
, &data
.dst
, &m_ptr_qry
);
2509 check_access (stmt
, /*dstwrite=*/ NULL_TREE
,
2510 /*maxread=*/ NULL_TREE
, /*srcstr=*/ src
,
2511 dstsize
, data
.mode
, &data
, m_ptr_qry
.rvals
);
2514 /* Check to see if the argument was declared attribute nonstring
2515 and if so, issue a warning since at this point it's not known
2516 to be nul-terminated. */
2517 tree fndecl
= get_callee_fndecl (stmt
);
2518 maybe_warn_nonstring_arg (fndecl
, stmt
);
2521 /* Check a call STMT to stpncpy() or strncpy() for overflow and warn
2525 pass_waccess::check_stxncpy (gcall
*stmt
)
2527 if (!warn_stringop_overflow
)
2530 tree dst
= call_arg (stmt
, 0);
2531 tree src
= call_arg (stmt
, 1);
2532 /* The number of bytes to write (not the maximum). */
2533 tree len
= call_arg (stmt
, 2);
2535 access_data
data (m_ptr_qry
.rvals
, stmt
, access_read_write
, len
, true, len
,
2537 const int ost
= warn_stringop_overflow
? warn_stringop_overflow
- 1 : 1;
2538 compute_objsize (src
, stmt
, ost
, &data
.src
, &m_ptr_qry
);
2539 tree dstsize
= compute_objsize (dst
, stmt
, ost
, &data
.dst
, &m_ptr_qry
);
2541 check_access (stmt
, /*dstwrite=*/len
, /*maxread=*/len
, src
, dstsize
,
2542 data
.mode
, &data
, m_ptr_qry
.rvals
);
2545 /* Check a call STMT to stpncpy() or strncpy() for overflow and warn
2549 pass_waccess::check_strncmp (gcall
*stmt
)
2551 if (!warn_stringop_overread
)
2554 tree arg1
= call_arg (stmt
, 0);
2555 tree arg2
= call_arg (stmt
, 1);
2556 tree bound
= call_arg (stmt
, 2);
2558 /* First check each argument separately, considering the bound. */
2559 if (!check_nul_terminated_array (stmt
, arg1
, bound
)
2560 || !check_nul_terminated_array (stmt
, arg2
, bound
))
2563 /* A strncmp read from each argument is constrained not just by
2564 the bound but also by the length of the shorter string. Specifying
2565 a bound that's larger than the size of either array makes no sense
2566 and is likely a bug. When the length of neither of the two strings
2567 is known but the sizes of both of the arrays they are stored in is,
2568 issue a warning if the bound is larger than than the size of
2569 the larger of the two arrays. */
2571 c_strlen_data lendata1
{ }, lendata2
{ };
2572 tree len1
= c_strlen (arg1
, 1, &lendata1
);
2573 tree len2
= c_strlen (arg2
, 1, &lendata2
);
2575 if (len1
&& TREE_CODE (len1
) != INTEGER_CST
)
2577 if (len2
&& TREE_CODE (len2
) != INTEGER_CST
)
2581 /* If the length of both arguments was computed they must both be
2582 nul-terminated and no further checking is necessary regardless
2586 /* Check to see if the argument was declared with attribute nonstring
2587 and if so, issue a warning since at this point it's not known to be
2589 if (maybe_warn_nonstring_arg (get_callee_fndecl (stmt
), stmt
))
2592 access_data
adata1 (m_ptr_qry
.rvals
, stmt
, access_read_only
, NULL_TREE
, false,
2594 access_data
adata2 (m_ptr_qry
.rvals
, stmt
, access_read_only
, NULL_TREE
, false,
2597 /* Determine the range of the bound first and bail if it fails; it's
2598 cheaper than computing the size of the objects. */
2599 tree bndrng
[2] = { NULL_TREE
, NULL_TREE
};
2600 get_size_range (m_ptr_qry
.rvals
, bound
, stmt
, bndrng
, adata1
.src_bndrng
);
2601 if (!bndrng
[0] || integer_zerop (bndrng
[0]))
2604 if (len1
&& tree_int_cst_lt (len1
, bndrng
[0]))
2606 if (len2
&& tree_int_cst_lt (len2
, bndrng
[0]))
2609 /* compute_objsize almost never fails (and ultimately should never
2610 fail). Don't bother to handle the rare case when it does. */
2611 if (!compute_objsize (arg1
, stmt
, 1, &adata1
.src
, &m_ptr_qry
)
2612 || !compute_objsize (arg2
, stmt
, 1, &adata2
.src
, &m_ptr_qry
))
2615 /* Compute the size of the remaining space in each array after
2616 subtracting any offset into it. */
2617 offset_int rem1
= adata1
.src
.size_remaining ();
2618 offset_int rem2
= adata2
.src
.size_remaining ();
2620 /* Cap REM1 and REM2 at the other if the other's argument is known
2621 to be an unterminated array, either because there's no space
2622 left in it after adding its offset or because it's constant and
2624 if (rem1
== 0 || (rem1
< rem2
&& lendata1
.decl
))
2626 else if (rem2
== 0 || (rem2
< rem1
&& lendata2
.decl
))
2629 /* Point PAD at the array to reference in the note if a warning
2631 access_data
*pad
= len1
? &adata2
: &adata1
;
2632 offset_int maxrem
= wi::max (rem1
, rem2
, UNSIGNED
);
2633 if (lendata1
.decl
|| lendata2
.decl
2634 || maxrem
< wi::to_offset (bndrng
[0]))
2636 /* Warn when either argument isn't nul-terminated or the maximum
2637 remaining space in the two arrays is less than the bound. */
2638 tree func
= get_callee_fndecl (stmt
);
2639 location_t loc
= gimple_location (stmt
);
2640 maybe_warn_for_bound (OPT_Wstringop_overread
, loc
, stmt
, func
,
2641 bndrng
, wide_int_to_tree (sizetype
, maxrem
),
2646 /* Determine and check the sizes of the source and the destination
2647 of calls to __builtin_{bzero,memcpy,mempcpy,memset} calls. STMT is
2648 the call statement, DEST is the destination argument, SRC is the source
2649 argument or null, and SIZE is the number of bytes being accessed. Use
2650 Object Size type-0 regardless of the OPT_Wstringop_overflow_ setting.
2651 Return true on success (no overflow or invalid sizes), false otherwise. */
2654 pass_waccess::check_memop_access (gimple
*stmt
, tree dest
, tree src
, tree size
)
2656 /* For functions like memset and memcpy that operate on raw memory
2657 try to determine the size of the largest source and destination
2658 object using type-0 Object Size regardless of the object size
2659 type specified by the option. */
2660 access_data
data (m_ptr_qry
.rvals
, stmt
, access_read_write
);
2662 = src
? compute_objsize (src
, stmt
, 0, &data
.src
, &m_ptr_qry
) : NULL_TREE
;
2663 tree dstsize
= compute_objsize (dest
, stmt
, 0, &data
.dst
, &m_ptr_qry
);
2665 check_access (stmt
, size
, /*maxread=*/NULL_TREE
, srcsize
, dstsize
,
2666 data
.mode
, &data
, m_ptr_qry
.rvals
);
2669 /* A convenience wrapper for check_access to check access by a read-only
2670 function like puts or strcmp. */
2673 pass_waccess::check_read_access (gimple
*stmt
, tree src
,
2674 tree bound
/* = NULL_TREE */,
2677 if (!warn_stringop_overread
)
2680 if (bound
&& !useless_type_conversion_p (size_type_node
, TREE_TYPE (bound
)))
2681 bound
= fold_convert (size_type_node
, bound
);
2683 tree fndecl
= get_callee_fndecl (stmt
);
2684 maybe_warn_nonstring_arg (fndecl
, stmt
);
2686 access_data
data (m_ptr_qry
.rvals
, stmt
, access_read_only
, NULL_TREE
,
2687 false, bound
, true);
2688 compute_objsize (src
, stmt
, ost
, &data
.src
, &m_ptr_qry
);
2689 check_access (stmt
, /*dstwrite=*/ NULL_TREE
, /*maxread=*/ bound
,
2690 /*srcstr=*/ src
, /*dstsize=*/ NULL_TREE
, data
.mode
,
2691 &data
, m_ptr_qry
.rvals
);
2694 /* Return true if memory model ORD is constant in the context of STMT and
2695 set *CSTVAL to the constant value. Otherwise return false. Warn for
2699 memmodel_to_uhwi (tree ord
, gimple
*stmt
, unsigned HOST_WIDE_INT
*cstval
)
2701 unsigned HOST_WIDE_INT val
;
2703 if (TREE_CODE (ord
) == INTEGER_CST
)
2705 if (!tree_fits_uhwi_p (ord
))
2707 val
= tree_to_uhwi (ord
);
2711 /* Use the range query to determine constant values in the absence
2712 of constant proppagation (such as at -O0). */
2714 if (!get_range_query (cfun
)->range_of_expr (rng
, ord
, stmt
)
2715 || !rng
.constant_p ()
2716 || !rng
.singleton_p (&ord
))
2719 wide_int lob
= rng
.lower_bound ();
2720 if (!wi::fits_uhwi_p (lob
))
2723 val
= lob
.to_shwi ();
2726 if (targetm
.memmodel_check
)
2727 /* This might warn for an invalid VAL but return a conservatively
2729 val
= targetm
.memmodel_check (val
);
2730 else if (val
& ~MEMMODEL_MASK
)
2732 tree fndecl
= gimple_call_fndecl (stmt
);
2733 location_t loc
= gimple_location (stmt
);
2734 loc
= expansion_point_location_if_in_system_header (loc
);
2736 warning_at (loc
, OPT_Winvalid_memory_model
,
2737 "unknown architecture specifier in memory model "
2738 "%wi for %qD", val
, fndecl
);
2747 /* Valid memory model for each set of atomic built-in functions. */
2749 struct memmodel_pair
2752 const char* modname
;
2754 #define MEMMODEL_PAIR(val, str) \
2755 { MEMMODEL_ ## val, "memory_order_" str }
2758 /* Valid memory models in the order of increasing strength. */
2760 static const memmodel_pair memory_models
[] =
2761 { MEMMODEL_PAIR (RELAXED
, "relaxed"),
2762 MEMMODEL_PAIR (SEQ_CST
, "seq_cst"),
2763 MEMMODEL_PAIR (ACQUIRE
, "acquire"),
2764 MEMMODEL_PAIR (CONSUME
, "consume"),
2765 MEMMODEL_PAIR (RELEASE
, "release"),
2766 MEMMODEL_PAIR (ACQ_REL
, "acq_rel")
2769 /* Return the name of the memory model VAL. */
2772 memmodel_name (unsigned HOST_WIDE_INT val
)
2774 val
= memmodel_base (val
);
2776 for (unsigned i
= 0; i
!= sizeof memory_models
/ sizeof *memory_models
; ++i
)
2778 if (val
== memory_models
[i
].modval
)
2779 return memory_models
[i
].modname
;
2784 /* Indices of valid MEMORY_MODELS above for corresponding atomic operations. */
2785 static const unsigned char load_models
[] = { 0, 1, 2, 3, UCHAR_MAX
};
2786 static const unsigned char store_models
[] = { 0, 1, 4, UCHAR_MAX
};
2787 static const unsigned char xchg_models
[] = { 0, 1, 3, 4, 5, UCHAR_MAX
};
2788 static const unsigned char flag_clr_models
[] = { 0, 1, 4, UCHAR_MAX
};
2789 static const unsigned char all_models
[] = { 0, 1, 2, 3, 4, 5, UCHAR_MAX
};
2791 /* Check the success memory model argument ORD_SUCS to the call STMT to
2792 an atomic function and warn if it's invalid. If nonnull, also check
2793 the failure memory model ORD_FAIL and warn if it's invalid. Return
2794 true if a warning has been issued. */
2797 pass_waccess::maybe_warn_memmodel (gimple
*stmt
, tree ord_sucs
,
2798 tree ord_fail
, const unsigned char *valid
)
2800 unsigned HOST_WIDE_INT sucs
, fail
= 0;
2801 if (!memmodel_to_uhwi (ord_sucs
, stmt
, &sucs
)
2802 || (ord_fail
&& !memmodel_to_uhwi (ord_fail
, stmt
, &fail
)))
2805 bool is_valid
= false;
2807 for (unsigned i
= 0; valid
[i
] != UCHAR_MAX
; ++i
)
2809 memmodel model
= memory_models
[valid
[i
]].modval
;
2810 if (memmodel_base (sucs
) == model
)
2819 tree fndecl
= gimple_call_fndecl (stmt
);
2820 location_t loc
= gimple_location (stmt
);
2821 loc
= expansion_point_location_if_in_system_header (loc
);
2825 bool warned
= false;
2826 if (const char *modname
= memmodel_name (sucs
))
2827 warned
= warning_at (loc
, OPT_Winvalid_memory_model
,
2828 "invalid memory model %qs for %qD",
2831 warned
= warning_at (loc
, OPT_Winvalid_memory_model
,
2832 "invalid memory model %wi for %qD",
2838 /* Print a note with the valid memory models. */
2840 pp_show_color (&pp
) = pp_show_color (global_dc
->printer
);
2841 for (unsigned i
= 0; valid
[i
] != UCHAR_MAX
; ++i
)
2843 const char *modname
= memory_models
[valid
[i
]].modname
;
2844 pp_printf (&pp
, "%s%<%s%>", i
? ", " : "", modname
);
2847 inform (loc
, "valid models are %s", pp_formatted_text (&pp
));
2854 if (fail
== MEMMODEL_RELEASE
|| fail
== MEMMODEL_ACQ_REL
)
2855 if (const char *failname
= memmodel_name (fail
))
2857 /* If both memory model arguments are valid but their combination
2858 is not, use their names in the warning. */
2859 if (!warning_at (loc
, OPT_Winvalid_memory_model
,
2860 "invalid failure memory model %qs for %qD",
2865 "valid failure models are %qs, %qs, %qs, %qs",
2866 "memory_order_relaxed", "memory_order_seq_cst",
2867 "memory_order_acquire", "memory_order_consume");
2871 if (memmodel_base (fail
) <= memmodel_base (sucs
))
2874 if (const char *sucsname
= memmodel_name (sucs
))
2875 if (const char *failname
= memmodel_name (fail
))
2877 /* If both memory model arguments are valid but their combination
2878 is not, use their names in the warning. */
2879 if (!warning_at (loc
, OPT_Winvalid_memory_model
,
2880 "failure memory model %qs cannot be stronger "
2881 "than success memory model %qs for %qD",
2882 failname
, sucsname
, fndecl
))
2885 /* Print a note with the valid failure memory models which are
2886 those with a value less than or equal to the success mode. */
2889 for (unsigned i
= 0;
2890 memory_models
[i
].modval
<= memmodel_base (sucs
); ++i
)
2895 const char *modname
= memory_models
[valid
[i
]].modname
;
2896 sprintf (buf
+ strlen (buf
), "'%s'", modname
);
2899 inform (loc
, "valid models are %s", buf
);
2903 /* If either memory model argument value is invalid use the numerical
2904 value of both in the message. */
2905 return warning_at (loc
, OPT_Winvalid_memory_model
,
2906 "failure memory model %wi cannot be stronger "
2907 "than success memory model %wi for %qD",
2908 fail
, sucs
, fndecl
);
2911 /* Wrapper for the above. */
2914 pass_waccess::check_atomic_memmodel (gimple
*stmt
, tree ord_sucs
,
2915 tree ord_fail
, const unsigned char *valid
)
2917 if (warning_suppressed_p (stmt
, OPT_Winvalid_memory_model
))
2920 if (maybe_warn_memmodel (stmt
, ord_sucs
, ord_fail
, valid
))
2923 suppress_warning (stmt
, OPT_Winvalid_memory_model
);
2926 /* Check a call STMT to an atomic or sync built-in. */
2929 pass_waccess::check_atomic_builtin (gcall
*stmt
)
2931 tree callee
= gimple_call_fndecl (stmt
);
2935 /* The size in bytes of the access by the function, and the number
2936 of the second argument to check (if any). */
2937 unsigned bytes
= 0, arg2
= UINT_MAX
;
2938 unsigned sucs_arg
= UINT_MAX
, fail_arg
= UINT_MAX
;
2939 /* Points to the array of indices of valid memory models. */
2940 const unsigned char *pvalid_models
= NULL
;
2942 switch (DECL_FUNCTION_CODE (callee
))
2944 #define BUILTIN_ACCESS_SIZE_FNSPEC(N) \
2945 BUILT_IN_SYNC_FETCH_AND_ADD_ ## N: \
2946 case BUILT_IN_SYNC_FETCH_AND_SUB_ ## N: \
2947 case BUILT_IN_SYNC_FETCH_AND_OR_ ## N: \
2948 case BUILT_IN_SYNC_FETCH_AND_AND_ ## N: \
2949 case BUILT_IN_SYNC_FETCH_AND_XOR_ ## N: \
2950 case BUILT_IN_SYNC_FETCH_AND_NAND_ ## N: \
2951 case BUILT_IN_SYNC_ADD_AND_FETCH_ ## N: \
2952 case BUILT_IN_SYNC_SUB_AND_FETCH_ ## N: \
2953 case BUILT_IN_SYNC_OR_AND_FETCH_ ## N: \
2954 case BUILT_IN_SYNC_AND_AND_FETCH_ ## N: \
2955 case BUILT_IN_SYNC_XOR_AND_FETCH_ ## N: \
2956 case BUILT_IN_SYNC_NAND_AND_FETCH_ ## N: \
2957 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_ ## N: \
2958 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_ ## N: \
2959 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_ ## N: \
2960 case BUILT_IN_SYNC_LOCK_RELEASE_ ## N: \
2963 case BUILT_IN_ATOMIC_LOAD_ ## N: \
2964 pvalid_models = load_models; \
2967 case BUILT_IN_ATOMIC_STORE_ ## N: \
2968 if (!pvalid_models) \
2969 pvalid_models = store_models; \
2971 case BUILT_IN_ATOMIC_ADD_FETCH_ ## N: \
2972 case BUILT_IN_ATOMIC_SUB_FETCH_ ## N: \
2973 case BUILT_IN_ATOMIC_AND_FETCH_ ## N: \
2974 case BUILT_IN_ATOMIC_NAND_FETCH_ ## N: \
2975 case BUILT_IN_ATOMIC_XOR_FETCH_ ## N: \
2976 case BUILT_IN_ATOMIC_OR_FETCH_ ## N: \
2977 case BUILT_IN_ATOMIC_FETCH_ADD_ ## N: \
2978 case BUILT_IN_ATOMIC_FETCH_SUB_ ## N: \
2979 case BUILT_IN_ATOMIC_FETCH_AND_ ## N: \
2980 case BUILT_IN_ATOMIC_FETCH_NAND_ ## N: \
2981 case BUILT_IN_ATOMIC_FETCH_OR_ ## N: \
2982 case BUILT_IN_ATOMIC_FETCH_XOR_ ## N: \
2984 if (sucs_arg == UINT_MAX) \
2986 if (!pvalid_models) \
2987 pvalid_models = all_models; \
2989 case BUILT_IN_ATOMIC_EXCHANGE_ ## N: \
2992 pvalid_models = xchg_models; \
2994 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_ ## N: \
2998 pvalid_models = all_models; \
3001 case BUILTIN_ACCESS_SIZE_FNSPEC (1);
3003 case BUILTIN_ACCESS_SIZE_FNSPEC (2);
3005 case BUILTIN_ACCESS_SIZE_FNSPEC (4);
3007 case BUILTIN_ACCESS_SIZE_FNSPEC (8);
3009 case BUILTIN_ACCESS_SIZE_FNSPEC (16);
3012 case BUILT_IN_ATOMIC_CLEAR
:
3014 pvalid_models
= flag_clr_models
;
3021 unsigned nargs
= gimple_call_num_args (stmt
);
3022 if (sucs_arg
< nargs
)
3024 tree ord_sucs
= gimple_call_arg (stmt
, sucs_arg
);
3025 tree ord_fail
= NULL_TREE
;
3026 if (fail_arg
< nargs
)
3027 ord_fail
= gimple_call_arg (stmt
, fail_arg
);
3028 check_atomic_memmodel (stmt
, ord_sucs
, ord_fail
, pvalid_models
);
3034 tree size
= build_int_cstu (sizetype
, bytes
);
3035 tree dst
= gimple_call_arg (stmt
, 0);
3036 check_memop_access (stmt
, dst
, NULL_TREE
, size
);
3038 if (arg2
!= UINT_MAX
)
3040 tree dst
= gimple_call_arg (stmt
, arg2
);
3041 check_memop_access (stmt
, dst
, NULL_TREE
, size
);
3047 /* Check call STMT to a built-in function for invalid accesses. Return
3048 true if a call has been handled. */
3051 pass_waccess::check_builtin (gcall
*stmt
)
3053 tree callee
= gimple_call_fndecl (stmt
);
3057 switch (DECL_FUNCTION_CODE (callee
))
3059 case BUILT_IN_ALLOCA
:
3060 case BUILT_IN_ALLOCA_WITH_ALIGN
:
3061 case BUILT_IN_ALLOCA_WITH_ALIGN_AND_MAX
:
3062 check_alloca (stmt
);
3065 case BUILT_IN_EXECL
:
3066 case BUILT_IN_EXECLE
:
3067 case BUILT_IN_EXECLP
:
3068 case BUILT_IN_EXECV
:
3069 case BUILT_IN_EXECVE
:
3070 case BUILT_IN_EXECVP
:
3071 check_read_access (stmt
, call_arg (stmt
, 0));
3074 case BUILT_IN_GETTEXT
:
3076 case BUILT_IN_PUTS_UNLOCKED
:
3077 case BUILT_IN_STRDUP
:
3078 check_read_access (stmt
, call_arg (stmt
, 0));
3081 case BUILT_IN_INDEX
:
3082 case BUILT_IN_RINDEX
:
3083 case BUILT_IN_STRCHR
:
3084 case BUILT_IN_STRRCHR
:
3085 case BUILT_IN_STRLEN
:
3086 check_read_access (stmt
, call_arg (stmt
, 0));
3089 case BUILT_IN_FPUTS
:
3090 case BUILT_IN_FPUTS_UNLOCKED
:
3091 check_read_access (stmt
, call_arg (stmt
, 0));
3094 case BUILT_IN_STRNDUP
:
3095 case BUILT_IN_STRNLEN
:
3097 tree str
= call_arg (stmt
, 0);
3098 tree len
= call_arg (stmt
, 1);
3099 check_read_access (stmt
, str
, len
);
3103 case BUILT_IN_STRCAT
:
3104 check_strcat (stmt
);
3107 case BUILT_IN_STRNCAT
:
3108 check_strncat (stmt
);
3111 case BUILT_IN_STPCPY
:
3112 case BUILT_IN_STRCPY
:
3113 check_stxcpy (stmt
);
3116 case BUILT_IN_STPNCPY
:
3117 case BUILT_IN_STRNCPY
:
3118 check_stxncpy (stmt
);
3121 case BUILT_IN_STRCASECMP
:
3122 case BUILT_IN_STRCMP
:
3123 case BUILT_IN_STRPBRK
:
3124 case BUILT_IN_STRSPN
:
3125 case BUILT_IN_STRCSPN
:
3126 case BUILT_IN_STRSTR
:
3127 check_read_access (stmt
, call_arg (stmt
, 0));
3128 check_read_access (stmt
, call_arg (stmt
, 1));
3131 case BUILT_IN_STRNCASECMP
:
3132 case BUILT_IN_STRNCMP
:
3133 check_strncmp (stmt
);
3136 case BUILT_IN_MEMCMP
:
3138 tree a1
= call_arg (stmt
, 0);
3139 tree a2
= call_arg (stmt
, 1);
3140 tree len
= call_arg (stmt
, 2);
3141 check_read_access (stmt
, a1
, len
, 0);
3142 check_read_access (stmt
, a2
, len
, 0);
3146 case BUILT_IN_MEMCPY
:
3147 case BUILT_IN_MEMPCPY
:
3148 case BUILT_IN_MEMMOVE
:
3150 tree dst
= call_arg (stmt
, 0);
3151 tree src
= call_arg (stmt
, 1);
3152 tree len
= call_arg (stmt
, 2);
3153 check_memop_access (stmt
, dst
, src
, len
);
3157 case BUILT_IN_MEMCHR
:
3159 tree src
= call_arg (stmt
, 0);
3160 tree len
= call_arg (stmt
, 2);
3161 check_read_access (stmt
, src
, len
, 0);
3165 case BUILT_IN_MEMSET
:
3167 tree dst
= call_arg (stmt
, 0);
3168 tree len
= call_arg (stmt
, 2);
3169 check_memop_access (stmt
, dst
, NULL_TREE
, len
);
3174 if (check_atomic_builtin (stmt
))
3181 /* Returns the type of the argument ARGNO to function with type FNTYPE
3182 or null when the typoe cannot be determined or no such argument exists. */
3185 fntype_argno_type (tree fntype
, unsigned argno
)
3187 if (!prototype_p (fntype
))
3191 function_args_iterator it
;
3192 FOREACH_FUNCTION_ARGS (fntype
, argtype
, it
)
3199 /* Helper to append the "human readable" attribute access specification
3200 described by ACCESS to the array ATTRSTR with size STRSIZE. Used in
3204 append_attrname (const std::pair
<int, attr_access
> &access
,
3205 char *attrstr
, size_t strsize
)
3207 if (access
.second
.internal_p
)
3210 tree str
= access
.second
.to_external_string ();
3211 gcc_assert (strsize
>= (size_t) TREE_STRING_LENGTH (str
));
3212 strcpy (attrstr
, TREE_STRING_POINTER (str
));
3215 /* Iterate over attribute access read-only, read-write, and write-only
3216 arguments and diagnose past-the-end accesses and related problems
3217 in the function call EXP. */
3220 pass_waccess::maybe_check_access_sizes (rdwr_map
*rwm
, tree fndecl
, tree fntype
,
3223 auto_diagnostic_group adg
;
3225 /* Set if a warning has been issued for any argument (used to decide
3226 whether to emit an informational note at the end). */
3227 opt_code opt_warned
= no_warning
;
3229 /* A string describing the attributes that the warnings issued by this
3230 function apply to. Used to print one informational note per function
3231 call, rather than one per warning. That reduces clutter. */
3235 for (rdwr_map::iterator it
= rwm
->begin (); it
!= rwm
->end (); ++it
)
3237 std::pair
<int, attr_access
> access
= *it
;
3239 /* Get the function call arguments corresponding to the attribute's
3240 positional arguments. When both arguments have been specified
3241 there will be two entries in *RWM, one for each. They are
3242 cross-referenced by their respective argument numbers in
3243 ACCESS.PTRARG and ACCESS.SIZARG. */
3244 const int ptridx
= access
.second
.ptrarg
;
3245 const int sizidx
= access
.second
.sizarg
;
3247 gcc_assert (ptridx
!= -1);
3248 gcc_assert (access
.first
== ptridx
|| access
.first
== sizidx
);
3250 /* The pointer is set to null for the entry corresponding to
3251 the size argument. Skip it. It's handled when the entry
3252 corresponding to the pointer argument comes up. */
3253 if (!access
.second
.ptr
)
3256 tree ptrtype
= fntype_argno_type (fntype
, ptridx
);
3258 /* A function with a prototype was redeclared without one and
3259 the protype has been lost. See pr102759. Avoid dealing
3260 with this pathological case. */
3263 tree argtype
= TREE_TYPE (ptrtype
);
3265 /* The size of the access by the call in elements. */
3269 /* If only the pointer attribute operand was specified and
3270 not size, set SIZE to the greater of MINSIZE or size of
3271 one element of the pointed to type to detect smaller
3272 objects (null pointers are diagnosed in this case only
3273 if the pointer is also declared with attribute nonnull. */
3274 if (access
.second
.minsize
3275 && access
.second
.minsize
!= HOST_WIDE_INT_M1U
)
3276 access_nelts
= build_int_cstu (sizetype
, access
.second
.minsize
);
3277 else if (VOID_TYPE_P (argtype
) && access
.second
.mode
== access_none
)
3278 /* Treat access mode none on a void* argument as expecting
3279 as little as zero bytes. */
3280 access_nelts
= size_zero_node
;
3282 access_nelts
= size_one_node
;
3285 access_nelts
= rwm
->get (sizidx
)->size
;
3287 /* Format the value or range to avoid an explosion of messages. */
3289 tree sizrng
[2] = { size_zero_node
, build_all_ones_cst (sizetype
) };
3290 if (get_size_range (m_ptr_qry
.rvals
, access_nelts
, stmt
, sizrng
, 1))
3292 char *s0
= print_generic_expr_to_str (sizrng
[0]);
3293 if (tree_int_cst_equal (sizrng
[0], sizrng
[1]))
3295 gcc_checking_assert (strlen (s0
) < sizeof sizstr
);
3296 strcpy (sizstr
, s0
);
3300 char *s1
= print_generic_expr_to_str (sizrng
[1]);
3301 gcc_checking_assert (strlen (s0
) + strlen (s1
)
3302 < sizeof sizstr
- 4);
3303 sprintf (sizstr
, "[%.37s, %.37s]", s0
, s1
);
3311 /* Set if a warning has been issued for the current argument. */
3312 opt_code arg_warned
= no_warning
;
3313 location_t loc
= get_location (stmt
);
3314 tree ptr
= access
.second
.ptr
;
3316 && tree_int_cst_sgn (sizrng
[0]) < 0
3317 && tree_int_cst_sgn (sizrng
[1]) < 0)
3319 /* Warn about negative sizes. */
3320 if (access
.second
.internal_p
)
3322 const std::string argtypestr
3323 = access
.second
.array_as_string (ptrtype
);
3325 if (warning_at (loc
, OPT_Wstringop_overflow_
,
3326 "bound argument %i value %s is "
3327 "negative for a variable length array "
3328 "argument %i of type %s",
3330 ptridx
+ 1, argtypestr
.c_str ()))
3331 arg_warned
= OPT_Wstringop_overflow_
;
3333 else if (warning_at (loc
, OPT_Wstringop_overflow_
,
3334 "argument %i value %s is negative",
3335 sizidx
+ 1, sizstr
))
3336 arg_warned
= OPT_Wstringop_overflow_
;
3338 if (arg_warned
!= no_warning
)
3340 append_attrname (access
, attrstr
, sizeof attrstr
);
3341 /* Remember a warning has been issued and avoid warning
3342 again below for the same attribute. */
3343 opt_warned
= arg_warned
;
3348 /* The size of the access by the call in bytes. */
3349 tree access_size
= NULL_TREE
;
3350 if (tree_int_cst_sgn (sizrng
[0]) >= 0)
3352 if (COMPLETE_TYPE_P (argtype
))
3354 /* Multiply ACCESS_SIZE by the size of the type the pointer
3355 argument points to. If it's incomplete the size is used
3357 if (tree argsize
= TYPE_SIZE_UNIT (argtype
))
3358 if (TREE_CODE (argsize
) == INTEGER_CST
)
3360 const int prec
= TYPE_PRECISION (sizetype
);
3361 wide_int minsize
= wi::to_wide (sizrng
[0], prec
);
3362 minsize
*= wi::to_wide (argsize
, prec
);
3363 access_size
= wide_int_to_tree (sizetype
, minsize
);
3367 access_size
= access_nelts
;
3370 if (integer_zerop (ptr
))
3372 if (sizidx
>= 0 && tree_int_cst_sgn (sizrng
[0]) > 0)
3374 /* Warn about null pointers with positive sizes. This is
3375 different from also declaring the pointer argument with
3376 attribute nonnull when the function accepts null pointers
3377 only when the corresponding size is zero. */
3378 if (access
.second
.internal_p
)
3380 const std::string argtypestr
3381 = access
.second
.array_as_string (ptrtype
);
3383 if (warning_at (loc
, OPT_Wnonnull
,
3384 "argument %i of variable length "
3385 "array %s is null but "
3386 "the corresponding bound argument "
3388 ptridx
+ 1, argtypestr
.c_str (),
3389 sizidx
+ 1, sizstr
))
3390 arg_warned
= OPT_Wnonnull
;
3392 else if (warning_at (loc
, OPT_Wnonnull
,
3393 "argument %i is null but "
3394 "the corresponding size argument "
3396 ptridx
+ 1, sizidx
+ 1, sizstr
))
3397 arg_warned
= OPT_Wnonnull
;
3399 else if (access_size
&& access
.second
.static_p
)
3401 /* Warn about null pointers for [static N] array arguments
3402 but do not warn for ordinary (i.e., nonstatic) arrays. */
3403 if (warning_at (loc
, OPT_Wnonnull
,
3404 "argument %i to %<%T[static %E]%> "
3405 "is null where non-null expected",
3406 ptridx
+ 1, argtype
, access_size
))
3407 arg_warned
= OPT_Wnonnull
;
3410 if (arg_warned
!= no_warning
)
3412 append_attrname (access
, attrstr
, sizeof attrstr
);
3413 /* Remember a warning has been issued and avoid warning
3414 again below for the same attribute. */
3415 opt_warned
= OPT_Wnonnull
;
3420 access_data
data (m_ptr_qry
.rvals
, stmt
, access
.second
.mode
,
3421 NULL_TREE
, false, NULL_TREE
, false);
3422 access_ref
* const pobj
= (access
.second
.mode
== access_write_only
3423 ? &data
.dst
: &data
.src
);
3424 tree objsize
= compute_objsize (ptr
, stmt
, 1, pobj
, &m_ptr_qry
);
3426 /* The size of the destination or source object. */
3427 tree dstsize
= NULL_TREE
, srcsize
= NULL_TREE
;
3428 if (access
.second
.mode
== access_read_only
3429 || access
.second
.mode
== access_none
)
3431 /* For a read-only argument there is no destination. For
3432 no access, set the source as well and differentiate via
3433 the access flag below. */
3435 if (access
.second
.mode
== access_read_only
3436 || access
.second
.mode
== access_none
)
3438 /* For a read-only attribute there is no destination so
3439 clear OBJSIZE. This emits "reading N bytes" kind of
3440 diagnostics instead of the "writing N bytes" kind,
3441 unless MODE is none. */
3442 objsize
= NULL_TREE
;
3448 /* Clear the no-warning bit in case it was set by check_access
3449 in a prior iteration so that accesses via different arguments
3451 suppress_warning (stmt
, OPT_Wstringop_overflow_
, false);
3452 access_mode mode
= data
.mode
;
3453 if (mode
== access_deferred
)
3454 mode
= TYPE_READONLY (argtype
) ? access_read_only
: access_read_write
;
3455 check_access (stmt
, access_size
, /*maxread=*/ NULL_TREE
, srcsize
,
3456 dstsize
, mode
, &data
, m_ptr_qry
.rvals
);
3458 if (warning_suppressed_p (stmt
, OPT_Wstringop_overflow_
))
3459 opt_warned
= OPT_Wstringop_overflow_
;
3460 if (opt_warned
!= no_warning
)
3462 if (access
.second
.internal_p
)
3464 unsigned HOST_WIDE_INT nelts
=
3465 access_nelts
? access
.second
.minsize
: HOST_WIDE_INT_M1U
;
3466 tree arrtype
= build_printable_array_type (argtype
, nelts
);
3467 inform (loc
, "referencing argument %u of type %qT",
3468 ptridx
+ 1, arrtype
);
3471 /* If check_access issued a warning above, append the relevant
3472 attribute to the string. */
3473 append_attrname (access
, attrstr
, sizeof attrstr
);
3480 inform (get_location (fndecl
),
3481 "in a call to function %qD declared with attribute %qs",
3484 inform (get_location (stmt
),
3485 "in a call with type %qT and attribute %qs",
3488 else if (opt_warned
!= no_warning
)
3491 inform (get_location (fndecl
),
3492 "in a call to function %qD", fndecl
);
3494 inform (get_location (stmt
),
3495 "in a call with type %qT", fntype
);
3498 /* Set the bit in case if was cleared and not set above. */
3499 if (opt_warned
!= no_warning
)
3500 suppress_warning (stmt
, opt_warned
);
3503 /* Check call STMT to an ordinary (non-built-in) function for invalid
3504 accesses. Return true if a call has been handled. */
3507 pass_waccess::check_call (gcall
*stmt
)
3509 tree fntype
= gimple_call_fntype (stmt
);
3513 tree fntypeattrs
= TYPE_ATTRIBUTES (fntype
);
3517 /* Map of attribute accewss specifications for function arguments. */
3519 init_attr_rdwr_indices (&rdwr_idx
, fntypeattrs
);
3521 unsigned nargs
= call_nargs (stmt
);
3522 for (unsigned i
= 0; i
!= nargs
; ++i
)
3524 tree arg
= call_arg (stmt
, i
);
3526 /* Save the actual argument that corresponds to the access attribute
3527 operand for later processing. */
3528 if (attr_access
*access
= rdwr_idx
.get (i
))
3530 if (POINTER_TYPE_P (TREE_TYPE (arg
)))
3533 // A nonnull ACCESS->SIZE contains VLA bounds. */
3538 gcc_assert (access
->ptr
== NULL_TREE
);
3543 /* Check attribute access arguments. */
3544 tree fndecl
= gimple_call_fndecl (stmt
);
3545 maybe_check_access_sizes (&rdwr_idx
, fndecl
, fntype
, stmt
);
3547 check_alloc_size_call (stmt
);
3551 /* Check arguments in a call STMT for attribute nonstring. */
3554 check_nonstring_args (gcall
*stmt
)
3556 tree fndecl
= gimple_call_fndecl (stmt
);
3558 /* Detect passing non-string arguments to functions expecting
3559 nul-terminated strings. */
3560 maybe_warn_nonstring_arg (fndecl
, stmt
);
3563 /* Issue a warning if a deallocation function such as free, realloc,
3564 or C++ operator delete is called with an argument not returned by
3565 a matching allocation function such as malloc or the corresponding
3566 form of C++ operatorn new. */
3569 pass_waccess::maybe_check_dealloc_call (gcall
*call
)
3571 tree fndecl
= gimple_call_fndecl (call
);
3575 unsigned argno
= fndecl_dealloc_argno (fndecl
);
3576 if ((unsigned) call_nargs (call
) <= argno
)
3579 tree ptr
= gimple_call_arg (call
, argno
);
3580 if (integer_zerop (ptr
))
3584 if (!compute_objsize (ptr
, call
, 0, &aref
, &m_ptr_qry
))
3587 tree ref
= aref
.ref
;
3588 if (integer_zerop (ref
))
3591 tree dealloc_decl
= fndecl
;
3592 location_t loc
= gimple_location (call
);
3594 if (DECL_P (ref
) || EXPR_P (ref
))
3596 /* Diagnose freeing a declared object. */
3597 if (aref
.ref_declared ()
3598 && warning_at (loc
, OPT_Wfree_nonheap_object
,
3599 "%qD called on unallocated object %qD",
3602 inform (get_location (ref
), "declared here");
3606 /* Diagnose freeing a pointer that includes a positive offset.
3607 Such a pointer cannot refer to the beginning of an allocated
3608 object. A negative offset may refer to it. */
3609 if (aref
.sizrng
[0] != aref
.sizrng
[1]
3610 && warn_dealloc_offset (loc
, call
, aref
))
3613 else if (CONSTANT_CLASS_P (ref
))
3615 if (warning_at (loc
, OPT_Wfree_nonheap_object
,
3616 "%qD called on a pointer to an unallocated "
3617 "object %qE", dealloc_decl
, ref
))
3619 if (TREE_CODE (ptr
) == SSA_NAME
)
3621 gimple
*def_stmt
= SSA_NAME_DEF_STMT (ptr
);
3622 if (is_gimple_assign (def_stmt
))
3624 location_t loc
= gimple_location (def_stmt
);
3625 inform (loc
, "assigned here");
3631 else if (TREE_CODE (ref
) == SSA_NAME
)
3633 /* Also warn if the pointer argument refers to the result
3634 of an allocation call like alloca or VLA. */
3635 gimple
*def_stmt
= SSA_NAME_DEF_STMT (ref
);
3639 if (is_gimple_call (def_stmt
))
3641 bool warned
= false;
3642 if (gimple_call_alloc_p (def_stmt
))
3644 if (matching_alloc_calls_p (def_stmt
, dealloc_decl
))
3646 if (warn_dealloc_offset (loc
, call
, aref
))
3651 tree alloc_decl
= gimple_call_fndecl (def_stmt
);
3652 const opt_code opt
=
3653 (DECL_IS_OPERATOR_NEW_P (alloc_decl
)
3654 || DECL_IS_OPERATOR_DELETE_P (dealloc_decl
)
3655 ? OPT_Wmismatched_new_delete
3656 : OPT_Wmismatched_dealloc
);
3657 warned
= warning_at (loc
, opt
,
3658 "%qD called on pointer returned "
3659 "from a mismatched allocation "
3660 "function", dealloc_decl
);
3663 else if (gimple_call_builtin_p (def_stmt
, BUILT_IN_ALLOCA
)
3664 || gimple_call_builtin_p (def_stmt
,
3665 BUILT_IN_ALLOCA_WITH_ALIGN
))
3666 warned
= warning_at (loc
, OPT_Wfree_nonheap_object
,
3667 "%qD called on pointer to "
3668 "an unallocated object",
3670 else if (warn_dealloc_offset (loc
, call
, aref
))
3675 tree fndecl
= gimple_call_fndecl (def_stmt
);
3676 inform (gimple_location (def_stmt
),
3677 "returned from %qD", fndecl
);
3681 else if (gimple_nop_p (def_stmt
))
3683 ref
= SSA_NAME_VAR (ref
);
3684 /* Diagnose freeing a pointer that includes a positive offset. */
3685 if (TREE_CODE (ref
) == PARM_DECL
3687 && aref
.sizrng
[0] != aref
.sizrng
[1]
3688 && aref
.offrng
[0] > 0 && aref
.offrng
[1] > 0
3689 && warn_dealloc_offset (loc
, call
, aref
))
3695 /* Check call STMT for invalid accesses. */
3698 pass_waccess::check (gcall
*stmt
)
3700 if (gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
))
3701 check_builtin (stmt
);
3703 if (is_gimple_call (stmt
))
3706 maybe_check_dealloc_call (stmt
);
3708 check_nonstring_args (stmt
);
3711 /* Check basic block BB for invalid accesses. */
3714 pass_waccess::check (basic_block bb
)
3716 /* Iterate over statements, looking for function calls. */
3717 for (auto si
= gsi_start_bb (bb
); !gsi_end_p (si
); gsi_next (&si
))
3719 if (gcall
*call
= dyn_cast
<gcall
*> (gsi_stmt (si
)))
3724 /* Check function FUN for invalid accesses. */
3727 pass_waccess::execute (function
*fun
)
3729 /* Create a new ranger instance and associate it with FUN. */
3730 m_ptr_qry
.rvals
= enable_ranger (fun
);
3733 FOR_EACH_BB_FN (bb
, fun
)
3737 m_ptr_qry
.dump (dump_file
, (dump_flags
& TDF_DETAILS
) != 0);
3739 m_ptr_qry
.flush_cache ();
3741 /* Release the ranger instance and replace it with a global ranger.
3742 Also reset the pointer since calling disable_ranger() deletes it. */
3743 disable_ranger (fun
);
3744 m_ptr_qry
.rvals
= NULL
;
3751 /* Return a new instance of the pass. */
3754 make_pass_warn_access (gcc::context
*ctxt
)
3756 return new pass_waccess (ctxt
);