On Tue, 16 Nov 2021, Jakub Jelinek wrote:
> Hi!
>
> This function punts if the builtins have no arguments, but as can be seen
> on the testcase, even if it has some arguments but alloc_size attribute's
> arguments point to arguments that aren't passed, we get a warning earlier
> from the FE but should punt rather than ICE on it.
> Other users of alloc_size attribute e.g. in
> tree-object-size.c (alloc_object_size) punt similarly and similarly
> even in the same TU maybe_warn_nonstring_arg correctly verifies calls have
> enough arguments.
>
> Bootstrapped/regtested on x86_64-linux and i686-linux, ok for trunk?
OK.
Thanks,
Richard.
> 2021-11-16 Jakub Jelinek <ja...@redhat.com>
>
> PR tree-optimization/102009
> * gimple-ssa-warn-access.cc (pass_waccess::check_alloc_size_call):
> Punt if any of alloc_size arguments is out of bounds vs. number of
> call arguments.
>
> * gcc.dg/pr102009.c: New test.
>
> --- gcc/gimple-ssa-warn-access.cc.jj 2021-11-09 15:25:15.000000000 +0100
> +++ gcc/gimple-ssa-warn-access.cc 2021-11-15 17:22:44.769580185 +0100
> @@ -2335,10 +2335,6 @@ pass_waccess::check_alloca (gcall *stmt)
> void
> pass_waccess::check_alloc_size_call (gcall *stmt)
> {
> - if (gimple_call_num_args (stmt) < 1)
> - /* Avoid invalid calls to functions without a prototype. */
> - return;
> -
> tree fndecl = gimple_call_fndecl (stmt);
> if (fndecl && gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
> {
> @@ -2367,13 +2363,19 @@ pass_waccess::check_alloc_size_call (gca
> the actual argument(s) at those indices in ALLOC_ARGS. */
> int idx[2] = { -1, -1 };
> tree alloc_args[] = { NULL_TREE, NULL_TREE };
> + unsigned nargs = gimple_call_num_args (stmt);
>
> tree args = TREE_VALUE (alloc_size);
> idx[0] = TREE_INT_CST_LOW (TREE_VALUE (args)) - 1;
> + /* Avoid invalid calls to functions without a prototype. */
> + if ((unsigned) idx[0] >= nargs)
> + return;
> alloc_args[0] = call_arg (stmt, idx[0]);
> if (TREE_CHAIN (args))
> {
> idx[1] = TREE_INT_CST_LOW (TREE_VALUE (TREE_CHAIN (args))) - 1;
> + if ((unsigned) idx[1] >= nargs)
> + return;
> alloc_args[1] = call_arg (stmt, idx[1]);
> }
>
> --- gcc/testsuite/gcc.dg/pr102009.c.jj 2021-11-15 17:29:19.090162531
> +0100
> +++ gcc/testsuite/gcc.dg/pr102009.c 2021-11-15 17:30:08.328486037 +0100
> @@ -0,0 +1,10 @@
> +/* PR tree-optimization/102009 */
> +/* { dg-do compile } */
> +
> +void *realloc (); /* { dg-message "declared here" } */
> +
> +void *
> +foo (void *p)
> +{
> + return realloc (p); /* { dg-warning "too few arguments to built-in
> function 'realloc' expecting " } */
> +}
>
> Jakub
>
>
--
Richard Biener <rguent...@suse.de>
SUSE Software Solutions Germany GmbH, Maxfeldstrasse 5, 90409 Nuernberg,
Germany; GF: Ivo Totev; HRB 36809 (AG Nuernberg)
