https://gcc.gnu.org/bugzilla/show_bug.cgi?id=128216
Bug ID: 128216
Summary: analyzer: -Wanalyzer-use-after-free false negative
when the freed pointer is used through pointer
arithmetic
Product: gcc
Version: 17.0
Status: UNCONFIRMED
Keywords: false-negative
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: tianxinghe at smail dot nju.edu.cn
Target Milestone: ---
-fanalyzer does not report a use-after-free when the freed pointer is used
through pointer arithmetic, although it reports the same bug written as a
direct dereference.
Reproducer:
#include <stdlib.h>
int main(void) {
char *p = malloc(8);
free(p);
char *q = p + 4;
q[0] = 1;
return 0;
}
$ gcc -fanalyzer -c uaf_arith.c -o /dev/null
(no diagnostics)
Expected: -Wanalyzer-use-after-free [CWE-416], the same as for:
int main(void) {
char *p = malloc(8);
free(p);
*p = 1; /* warning: use after 'free' of 'p' [CWE-416] */
return 0;
}
which is correctly diagnosed.
The expression form does not matter: `*(p + 4) = 1;` is missed in the same way.
Versions tested, all miss it while diagnosing the direct dereference:
gcc 11.4.0 (Ubuntu 22.04)
gcc 12.3.0 (Ubuntu 22.04)
gcc 17.0.0 20261026 (master, source build)
Godbolt link: https://godbolt.org/z/jxcdbc9hP
This is a different manifestation of the same underlying issue as my earlier
report PR analyzer/128186 (a freed pointer passed to memset/memcpy/strcpy is
not diagnosed): in both cases the value that reaches the use site is not
carried as poisoned.
Thank you for maintaining -fanalyzer. I did not add a separate thank-you to
the earlier report (PR analyzer/128186) so as not to send extra mail; I would
like to express the appreciation here instead.
Note: maybe_fold_unaryop propagates poisoned operands
(region-model-manager.cc:444) but maybe_fold_binop does not (:680).
