https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98247
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Ever confirmed|0 |1
Summary|RFE: detect Flexible Array |Analyzer fails to detect
|Member misuse in analyzer |certain out-of-bounds uses
| |of flexible array members
Last reconfirmed| |2022-09-09
Status|UNCONFIRMED |NEW
Version|11.0 |13.0
--- Comment #5 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
The above patch adds test coverage for various uses of the flexible array
member idiom, inspired by your test case above (thanks!)
It adds one xfail; in test_symbolic_size_oob, where there's a false negative,
where it fails to complain about this code:
struct str *
test_symbolic_size_oob (size_t len)
{
/* Forgetting to add space for the trailing array. */
struct str *str = malloc(sizeof(str));
if (str) {
str->len = len;
memset(str->data, 'x', len); /* { dg-warning "heap-based buffer overflow"
"PR analyzer/98247" { xfail *-*-* } } */
// TODO(xfail): we don't yet complain about this case, which occurs when
len > 0
return str;
}
return NULL;
}
I'm going to repurpose this bug to track fixing that false negative; updating
subject accordingly.
