https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81023
Bug ID: 81023
Summary: False positiv stack-use-after-scope (worked with GCC
6, fails with GCC 7)
Product: gcc
Version: unknown
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: sanitizer
Assignee: unassigned at gcc dot gnu.org
Reporter: d.frey at gmx dot de
CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
jakub at gcc dot gnu.org, kcc at gcc dot gnu.org, marxin at
gcc dot gnu.org
Target Milestone: ---
Created attachment 41506
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=41506&action=edit
Minimal program to reproduce the problem
I got a report from address sanitizer about a stack-use-after-scope, which I
believe is a false positive. I managed to shrink the code down to 99 lines, but
no further (that already took 2.5 days).
Code properties:
- No includes
- No templates
- No loops
- No recursion
- No heap allocations
- Compiles cleanly with -pedantic -Wall -Wextra -Werror
Problem properties:
- Using GCC 6 (and its address sanitizer) solves the problem, only GCC 7
reports it.
- Some flags like -O0 or -O3 solve the problem, -O1 still produces it.
- Using -fno-inline solves the problem.
- Almost every change to the code in order to simplify it will solve the
problem.
I'm at a total loss as to what is wrong and I am pretty sure the code itself it
not accessing the stack after the scope is gone.
The area I am suspicious about is: I'm throwing an exception and the destructor
of the class "marker" is writing some bytes (assignment of "iterator"). Is this
confusing the address sanitizer?
My system (g++ --version):
g++-7 (Ubuntu 7.1.0-5ubuntu2~14.04) 7.1.0
Output:
frey@vbox::~/work/test/address_sanitizer_false_positive$ g++-7 -std=c++14
-pedantic -Wall -Wextra -Werror -fsanitize=address -fuse-ld=gold -O1 -g t.cpp
-o t && ./t
=================================================================
==17925==ERROR: AddressSanitizer: stack-use-after-scope on address
0x7fff9bd67ef0 at pc 0x000000401112 bp 0x7fff9bd67e80 sp 0x7fff9bd67e78
WRITE of size 24 at 0x7fff9bd67ef0 thread T0
#0 0x401111 in marker::marker(iterator&)
/home/frey/work/test/address_sanitizer_false_positive/t.cpp:22
#1 0x401111 in input::mark()
/home/frey/work/test/address_sanitizer_false_positive/t.cpp:59
#2 0x401111 in rule::match(input&)
/home/frey/work/test/address_sanitizer_false_positive/t.cpp:71
#3 0x401111 in match(input&)
/home/frey/work/test/address_sanitizer_false_positive/t.cpp:81
#4 0x40141f in verify_fail(char const*)
/home/frey/work/test/address_sanitizer_false_positive/t.cpp:88
#5 0x4014c0 in main
/home/frey/work/test/address_sanitizer_false_positive/t.cpp:97
#6 0x7f30c3f75f44 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21f44)
#7 0x400ca8
(/home/frey/work/test/address_sanitizer_false_positive/t+0x400ca8)
Address 0x7fff9bd67ef0 is located in stack of thread T0 at offset 96 in frame
#0 0x400d66 in match(input&)
/home/frey/work/test/address_sanitizer_false_positive/t.cpp:79
This frame has 2 object(s):
[32, 64) 'm'
[96, 128) 'm' <== Memory access at offset 96 is inside this variable
HINT: this may be a false positive if your program uses some custom stack
unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-scope
/home/frey/work/test/address_sanitizer_false_positive/t.cpp:22 in
marker::marker(iterator&)
Shadow bytes around the buggy address:
0x1000737a4f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000737a4f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000737a4fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000737a4fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000737a4fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x1000737a4fd0: 00 00 f1 f1 f1 f1 00 00 00 00 f2 f2 f2 f2[f8]f8
0x1000737a4fe0: f8 f8 f3 f3 f3 f3 00 00 00 00 00 00 f1 f1 f1 f1
0x1000737a4ff0: 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00 00 00 00
0x1000737a5000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000737a5010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1000737a5020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==17925==ABORTING
