https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127742
Bug ID: 127742
Summary: Flexible gnu::counted_by array nested in a struct
fails with "AddressSanitizer: global-buffer-overflow"
Product: gcc
Version: 16.2.1
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: sanitizer
Assignee: unassigned at gcc dot gnu.org
Reporter: git at maxchernoff dot ca
CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
jakub at gcc dot gnu.org, kcc at gcc dot gnu.org
Target Milestone: ---
Created attachment 65759
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=65759&action=edit
asan-counted_by-minimal.c
If I nest a struct with a gnu::counted_by flexible array inside of another
struct and try to dereference an array member, address sanitizer aborts the
program with a "global-buffer-overflow" error. If I compile with the address
sanitizer disabled, the program runs correctly.
A minimal example is the following C source code:
typedef struct {
int count;
[[gnu::counted_by(count)]] int values[];
} array_of_ints;
typedef struct {
array_of_ints inner;
} wrapper_struct;
wrapper_struct wrapped = {(array_of_ints){.count = 1, .values = {5}}};
int main() { return wrapped.inner.values[0]; }
which gives me the following runtime error message:
==1105977==ERROR: AddressSanitizer: global-buffer-overflow on address
0x000000403064 at pc 0x0000004004e6 bp0x7ffdd44ec000 sp 0x7ffdd44ebff8
READ of size 4 at 0x000000403064 thread T0
#0 0x0000004004e5 in main
(/home/max/Projects/TeX-Temp/asan-counted_by-minimal+0x4004e5) (BuildId:
a019243e317e4d64fd5e9afebb7dcd3d026cd714)
#1 0x7f510700a680 in __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:59
#2 0x7f510700a797 in __libc_start_main_impl ../csu/libc-start.c:360
#3 0x0000004003e4 in _start
(/home/max/Projects/TeX-Temp/asan-counted_by-minimal+0x4003e4) (BuildId:
a019243e317e4d64fd5e9afebb7dcd3d026cd714)
0x000000403064 is located 0 bytes after global variable 'wrapped' defined
in './asan-counted_by-minimal.c:8:16' (0x000000403060) of size 4
SUMMARY: AddressSanitizer: global-buffer-overflow
(/home/max/Projects/TeX-Temp/asan-counted_by-minimal+0x4004e5) (BuildId:
a019243e317e4d64fd5e9afebb7dcd3d026cd714) in main
The code compiles without any errors with "-Wall -Wextra -Werror -fanalyzer",
and produces the correct results if I compile and run it with the address
sanitizer disabled, so I _think_ that the code is correct and that the address
sanitizer error is spurious.
I'm using gcc v16.2.1 on Fedora 44 x86_64, and I've added the complete logs and
an alternate source file with a few comments to the attachment. Please let me
know if you have any questions or want me to test anything.
