https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119132
Kees Cook <kees at outflux dot net> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|INVALID |---
Status|RESOLVED |UNCONFIRMED
--- Comment #5 from Kees Cook <kees at outflux dot net> ---
(In reply to Andrew Pinski from comment #3)
> On &p->array[size + 1];
>
> The instrument is to make sure that would form a valid range of the index.
> Which is only 0...size.
>
> The instrumentation is not done on the pointer deference later on either.
What? No, only 0...size-1 are valid. The bounds sanitizer trips for
p->array[size]. That's correct behavior. But not for &(p->array[size]). That's
unexpected and dangerous.
