https://gcc.gnu.org/bugzilla/show_bug.cgi?id=128186
Bug ID: 128186
Summary: analyzer: -Wanalyzer-use-after-free false negative
when freed pointer is passed to memset/memcpy/strcpy
Product: gcc
Version: 17.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: tianxinghe at smail dot nju.edu.cn
Target Milestone: ---
-fanalyzer does not report a use-after-free when the freed pointer is used by
memset/memcpy/strcpy, although it correctly reports the equivalent direct
dereference and the corresponding double-free.
Reproducer (memset):
$ cat uaf_memset.c
#include <stdlib.h>
#include <string.h>
int main (void)
{
unsigned char *p = (unsigned char *)malloc (16);
free (p);
memset (p, 0, 16);
return 0;
}
$ gcc -fanalyzer -c uaf_memset.c -o /dev/null
(no diagnostics)
Expected: -Wanalyzer-use-after-free [CWE-416], the same as for:
int main (void)
{
unsigned char *p = (unsigned char *)malloc (16);
free (p);
p[0] = 1; /* warning: use after 'free' of 'p' [CWE-416] */
return 0;
}
which is correctly diagnosed.
Same false negative for:
char *p = malloc (16);
free (p);
strcpy (p, "x"); /* no warning */
void *p = malloc (8), *q = malloc (8);
free (p);
memcpy (p, q, 1); /* no warning (freed destination) */
Note the destination of memcpy is the missed case; the source is checked.
Versions tested, all miss the library-call forms while correctly diagnosing
double-free and direct dereference:
gcc 11.4.0 (Ubuntu 22.04)
gcc 12.3.0 (Ubuntu 22.04)
gcc 16.2.0 (release tarball, source build)
gcc 17.0.0 20261026 (master, source build)
Could you confirm whether this behaviour is intended? It is possible that I am
misunderstanding how the analyzer models these library calls, or that this is a
deliberate trade-off rather than a false negative. If so, a brief explanation
of the design would be very helpful. Thank you.
