https://gcc.gnu.org/bugzilla/show_bug.cgi?id=128196
Bug ID: 128196
Summary: [14/15/16/17 Regression] wrong strlen result after
strnlen of a string with a known prefix
Product: gcc
Version: 17.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: tree-optimization
Assignee: unassigned at gcc dot gnu.org
Reporter: lzy20000419 at outlook dot com
Target Milestone: ---
#include <string.h>
__attribute__((noipa)) size_t
f (const char *s)
{
char b[16];
strcpy (b, s);
memcpy (b, "abc", 3);
size_t n = strnlen (b, 5);
return n * 100 + strlen (b);
}
int
main (void)
{
if (f ("0123456789") != 510)
__builtin_abort ();
return 0;
}
$ gcc -O2 t.c && ./a.out Aborted
Expected: no abort (strnlen = 5, strlen = 10). The strlen1 dump shows _2 =
__builtin_strlen (&b); into: _2 = n_6;, i.e. the strnlen result is used as the
full length of b. -O0, -O1, -Os and clang are fine;
-fsanitize=address,undefined is clean. Also fails at -O3.
It fails with 9.1 through 16.2 and trunk; 8.5 is fine.
https://godbolt.org/z/Y9rsoG6WY (left gcc 8.3, right trunk)
Disclaimer: This test case was generated by a fuzzer, and the report was
written with LLM assistance.
