From eacdfaf7ca07367ede1a0c50aa997953958dabae Mon Sep 17 00:00:00 2001
From: Jakub Jelinek <jakub@redhat.com>
Date: Tue, 16 Nov 2021 10:18:25 +0100
Subject: [PATCH] waccess: Fix up pass_waccess::check_alloc_size_call
[PR102009]
This function punts if the builtins have no arguments, but as can be seen
on the testcase, even if it has some arguments but alloc_size attribute's
arguments point to arguments that aren't passed, we get a warning earlier
from the FE but should punt rather than ICE on it.
Other users of alloc_size attribute e.g. in
tree-object-size.c (alloc_object_size) punt similarly and similarly
even in the same TU maybe_warn_nonstring_arg correctly verifies calls have
enough arguments.
2021-11-16 Jakub Jelinek <jakub@redhat.com>
PR tree-optimization/102009
* gimple-ssa-warn-access.cc (pass_waccess::check_alloc_size_call):
Punt if any of alloc_size arguments is out of bounds vs. number of
call arguments.
* gcc.dg/pr102009.c: New test.
---
gcc/gimple-ssa-warn-access.cc | 10 ++++++----
gcc/testsuite/gcc.dg/pr102009.c | 10 ++++++++++
2 files changed, 16 insertions(+), 4 deletions(-)
create mode 100644 gcc/testsuite/gcc.dg/pr102009.c
diff --git a/gcc/gimple-ssa-warn-access.cc b/gcc/gimple-ssa-warn-access.cc
index 073f122af31b..22c791d833a0 100644
--- a/gcc/gimple-ssa-warn-access.cc
+++ b/gcc/gimple-ssa-warn-access.cc
@@ -2335,10 +2335,6 @@ pass_waccess::check_alloca (gcall *stmt)
void
pass_waccess::check_alloc_size_call (gcall *stmt)
{
- if (gimple_call_num_args (stmt) < 1)
- /* Avoid invalid calls to functions without a prototype. */
- return;
-
tree fndecl = gimple_call_fndecl (stmt);
if (fndecl && gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
{
@@ -2367,13 +2363,19 @@ pass_waccess::check_alloc_size_call (gcall *stmt)
the actual argument(s) at those indices in ALLOC_ARGS. */
int idx[2] = { -1, -1 };
tree alloc_args[] = { NULL_TREE, NULL_TREE };
+ unsigned nargs = gimple_call_num_args (stmt);
tree args = TREE_VALUE (alloc_size);
idx[0] = TREE_INT_CST_LOW (TREE_VALUE (args)) - 1;
+ /* Avoid invalid calls to functions without a prototype. */
+ if ((unsigned) idx[0] >= nargs)
+ return;
alloc_args[0] = call_arg (stmt, idx[0]);
if (TREE_CHAIN (args))
{
idx[1] = TREE_INT_CST_LOW (TREE_VALUE (TREE_CHAIN (args))) - 1;
+ if ((unsigned) idx[1] >= nargs)
+ return;
alloc_args[1] = call_arg (stmt, idx[1]);
}
diff --git a/gcc/testsuite/gcc.dg/pr102009.c b/gcc/testsuite/gcc.dg/pr102009.c
new file mode 100644
index 000000000000..5b3a39bd0db9
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/pr102009.c
@@ -0,0 +1,10 @@
+/* PR tree-optimization/102009 */
+/* { dg-do compile } */
+
+void *realloc (); /* { dg-message "declared here" } */
+
+void *
+foo (void *p)
+{
+ return realloc (p); /* { dg-warning "too few arguments to built-in function 'realloc' expecting " } */
+}
--
GitLab