https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126806
Bug ID: 126806
Summary: [analyzer] false fd-leak warning for a caller-owned
struct member
Product: gcc
Version: 16.1.0
Status: UNCONFIRMED
Keywords: diagnostic
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: hello at bjornpagen dot com
Target Milestone: ---
Host: aarch64-apple-darwin24
Target: aarch64-apple-darwin24
Build: aarch64-apple-darwin24
Created attachment 65308
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=65308&action=edit
Plain C reduced testcase
The analyzer reports a caller-owned listening socket as leaked when a function
reads it through a struct pointer and passes it to accept. The caller still
owns the socket. The accepted descriptor is closed. The analyzer should not
report a leak.
Testcase:
#include <sys/socket.h>
#include <unistd.h>
struct server {
int listener;
};
int accept_one(struct server *s)
{
int fd = accept(s->listener, 0, 0);
if (fd < 0)
return -1;
close(fd);
return 0;
}
Command:
gcc-16 -O2 -fanalyzer -c repro.c
Compiler output:
repro.c:12:18: warning: leak of file descriptor '*s.listener' [CWE-775]
[-Wanalyzer-fd-leak]
Expected result:
The analyzer emits no diagnostic. The function does not take ownership of
s->listener. It closes the descriptor returned by accept.
Versions tested:
GCC 16.1.0 reproduces the warning on aarch64-apple-darwin24.
The official gcc:16.1.0 container reproduces it on aarch64-linux.
GCC master commit 475e9efffaf8de781d7e17b687faf1807e104b01 reproduces it on
aarch64-linux.
The testcase compiles cleanly with -Wall -Wextra when -fanalyzer is absent.
The warning also occurs at -O0 and -O1.
Environment:
Using built-in specs.
COLLECT_GCC=g++-16
COLLECT_LTO_WRAPPER=/Users/bjorn/.gcc/versions/16.1.0/libexec/gcc/aarch64-apple-darwin24/16.1.0/lto-wrapper
Target: aarch64-apple-darwin24
Configured with: ../gcc-16.1.0/configure
--prefix=/Users/bjorn/.gcc/versions/16.1.0 --enable-languages=c,c++
--disable-nls --enable-checking=release --program-suffix=-16 --with-system-zlib
--build=aarch64-apple-darwin24
--with-sysroot=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 16.1.0 (GCC)
PR 114677 covers an fd stored through an int pointer. PR 108648 is a larger
field report involving fd members. Neither contains this accept-based
reduction.
