analyzer: handle function attribute "alloc_size" [PR110426]
This patch makes -fanalyzer make use of the function attribute
"alloc_size", allowing -fanalyzer to emit -Wanalyzer-allocation-size,
-Wanalyzer-out-of-bounds, and -Wanalyzer-tainted-allocation-size on
execution paths involving allocations using such functions.
gcc/analyzer/ChangeLog:
PR analyzer/110426
* bounds-checking.cc (region_model::check_region_bounds): Handle
symbolic base regions.
* call-details.cc: Include "stringpool.h" and "attribs.h".
(call_details::lookup_function_attribute): New function.
* call-details.h (call_details::lookup_function_attribute): New
function decl.
* region-model-manager.cc
(region_model_manager::maybe_fold_binop): Add reference to
PR analyzer/110902.
* region-model-reachability.cc (reachable_regions::handle_sval):
Add symbolic regions for pointers that are conjured svalues for
the LHS of a stmt.
* region-model.cc (region_model::canonicalize): Purge dynamic
extents for regions that aren't referenced.
(get_result_size_in_bytes): New function.
(region_model::on_call_pre): Use get_result_size_in_bytes and
potentially set the dynamic extents of the region pointed to by
the return value.
(region_model::deref_rvalue): Add param "add_nonnull_constraint"
and use it to conditionalize adding the constraint.
(pending_diagnostic_subclass::dubious_allocation_size): Add "stmt"
param to both ctors and use it to initialize new "m_stmt" field.
(pending_diagnostic_subclass::operator==): Use m_stmt; don't use
m_lhs or m_rhs.
(pending_diagnostic_subclass::m_stmt): New field.
(region_model::check_region_size): Generalize to any kind of
pointer svalue by using deref_rvalue rather than checking for
region_svalue. Pass stmt to dubious_allocation_size ctor.
* region-model.h (region_model::deref_rvalue): Add param
"add_nonnull_constraint".
* svalue.cc (conjured_svalue::lhs_value_p): New function.
* svalue.h (conjured_svalue::lhs_value_p): New decl.
gcc/testsuite/ChangeLog:
PR analyzer/110426
* gcc.dg/analyzer/allocation-size-1.c: Update expected message to
reflect consolidation of size and assignment into a single event.
* gcc.dg/analyzer/allocation-size-2.c: Likewise.
* gcc.dg/analyzer/allocation-size-3.c: Likewise.
* gcc.dg/analyzer/allocation-size-4.c: Likewise.
* gcc.dg/analyzer/allocation-size-multiline-1.c: Likewise.
* gcc.dg/analyzer/allocation-size-multiline-2.c: Likewise.
* gcc.dg/analyzer/allocation-size-multiline-3.c: Likewise.
* gcc.dg/analyzer/attr-alloc_size-1.c: New test.
* gcc.dg/analyzer/attr-alloc_size-2.c: New test.
* gcc.dg/analyzer/attr-alloc_size-3.c: New test.
* gcc.dg/analyzer/explode-4.c: New test.
* gcc.dg/analyzer/taint-size-1.c: Add test coverage for
__attribute__ alloc_size.
Signed-off-by:
David Malcolm <dmalcolm@redhat.com>
Showing
- gcc/analyzer/bounds-checking.cc 3 additions, 9 deletionsgcc/analyzer/bounds-checking.cc
- gcc/analyzer/call-details.cc 21 additions, 0 deletionsgcc/analyzer/call-details.cc
- gcc/analyzer/call-details.h 2 additions, 0 deletionsgcc/analyzer/call-details.h
- gcc/analyzer/region-model-manager.cc 2 additions, 0 deletionsgcc/analyzer/region-model-manager.cc
- gcc/analyzer/region-model-reachability.cc 21 additions, 0 deletionsgcc/analyzer/region-model-reachability.cc
- gcc/analyzer/region-model.cc 92 additions, 17 deletionsgcc/analyzer/region-model.cc
- gcc/analyzer/region-model.h 2 additions, 1 deletiongcc/analyzer/region-model.h
- gcc/analyzer/svalue.cc 11 additions, 0 deletionsgcc/analyzer/svalue.cc
- gcc/analyzer/svalue.h 1 addition, 0 deletionsgcc/analyzer/svalue.h
- gcc/testsuite/gcc.dg/analyzer/allocation-size-1.c 1 addition, 2 deletionsgcc/testsuite/gcc.dg/analyzer/allocation-size-1.c
- gcc/testsuite/gcc.dg/analyzer/allocation-size-2.c 1 addition, 2 deletionsgcc/testsuite/gcc.dg/analyzer/allocation-size-2.c
- gcc/testsuite/gcc.dg/analyzer/allocation-size-3.c 3 additions, 6 deletionsgcc/testsuite/gcc.dg/analyzer/allocation-size-3.c
- gcc/testsuite/gcc.dg/analyzer/allocation-size-4.c 2 additions, 4 deletionsgcc/testsuite/gcc.dg/analyzer/allocation-size-4.c
- gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c 5 additions, 7 deletionsgcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c
- gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c 6 additions, 9 deletionsgcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c
- gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c 4 additions, 6 deletionsgcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c
- gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-1.c 81 additions, 0 deletionsgcc/testsuite/gcc.dg/analyzer/attr-alloc_size-1.c
- gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-2.c 19 additions, 0 deletionsgcc/testsuite/gcc.dg/analyzer/attr-alloc_size-2.c
- gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-3.c 14 additions, 0 deletionsgcc/testsuite/gcc.dg/analyzer/attr-alloc_size-3.c
- gcc/testsuite/gcc.dg/analyzer/explode-4.c 157 additions, 0 deletionsgcc/testsuite/gcc.dg/analyzer/explode-4.c
Loading
Please register or sign in to comment