https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126831
Bug ID: 126831
Summary: -Wanalyzer-malloc-leak false positive when calling
extern function
Product: gcc
Version: 17.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Blocks: 126830
Target Milestone: ---
Reduced from lz4-1.10.0 LZ4IO_createDResources().
The analyzer falsely reports a malloc-leak for a heap pointer stored in a
struct field when the struct is returned by value. The leak is spurious
because the caller receives the struct (and the pointer within it) via the
return value.
The false positive is triggered when an external function call passes a pointer
to a different field of the same struct before the malloc. Without that call,
the analyzer correctly tracks the return-by-value.
$ cat t.c
extern void *malloc(unsigned long);
extern int setup(void *);
typedef struct {
void *buf;
void *ctx;
} res_t;
res_t create(void)
{
res_t r;
setup(&r.ctx);
r.buf = malloc(100);
return r; /* bogus leak of r.buf here */
}
$ gcc -fanalyzer -c t.c
t.c: In function 'create':
t.c:14:12: warning: leak of 'r.buf' [CWE-401] [-Wanalyzer-malloc-leak]
Trunk: https://godbolt.org/z/vKv54zj3K
Seen in the OpenScanHub mass scan (PR 126830) affecting lz4 and other packages
(part of "interprocedural constraint/contract loss" theme, est. 1,000-1,500
FPs).
Referenced Bugs:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126830
[Bug 126830] Tracker bug for -fanalyzer false positives seen in August 2026
OpenScanHub mass scan
