For a pointer to a subobject whose record/union type ends in a flexible-array
member (directly, or through its trailing nested struct), addr_object_size()
walked up to the enclosing object (v = TREE_OPERAND (v, 0)) instead of
measuring the referenced subobject. __builtin_object_size() and
__builtin_dynamic_object_size() type 1 therefore returned the whole-object
size, collapsing type 1 onto type 0 and losing the distinction between
&p->inner and p. FORTIFY_SOURCE relies on the type-1 distinction, so this
weakens its bounds checks.
Fix this by computing the size directly from the referenced record/union
instead of walking up, restoring the type-0/type-1 distinction that Clang
already implements.
Bootstraped and regtested on x86_64-linux-gnu.
PR tree-optimization/126975
gcc/ChangeLog:
* tree-object-size.cc (addr_object_size): For a reference to a
record or union type, compute the object size from the referenced
subobject instead of walking up to the enclosing object when the
type recursively includes a flexible array member.
gcc/testsuite/ChangeLog:
* gcc.dg/builtin-object-size-pr101832.c (main): Update the expected
results of __builtin_object_size (..., 1) queries on subobjects
whose type contains a flexible array member.
---
.../gcc.dg/builtin-object-size-pr101832.c | 6 +++---
gcc/tree-object-size.cc | 18 +++++-------------
2 files changed, 8 insertions(+), 16 deletions(-)
diff --git a/gcc/testsuite/gcc.dg/builtin-object-size-pr101832.c
b/gcc/testsuite/gcc.dg/builtin-object-size-pr101832.c
index 60078e11634..d76286ae454 100644
--- a/gcc/testsuite/gcc.dg/builtin-object-size-pr101832.c
+++ b/gcc/testsuite/gcc.dg/builtin-object-size-pr101832.c
@@ -92,9 +92,9 @@ int main (int argc, char *argv[])
outer = (void *)magic1;
outest = (void *)magic2;
- expect (__builtin_object_size (&outer->a, 1), -1);
- expect (__builtin_object_size (&outest->b, 1), -1);
- expect (__builtin_object_size (&outest->b.a, 1), -1);
+ expect (__builtin_object_size (&outer->a, 1), sizeof(outer->a));
+ expect (__builtin_object_size (&outest->b, 1), sizeof(outest->b));
+ expect (__builtin_object_size (&outest->b.a, 1), sizeof(outest->b.a));
struct B0 *outer0;
struct C0 *outest0;
diff --git a/gcc/tree-object-size.cc b/gcc/tree-object-size.cc
index 54c320d36d0..5c8b4ee7862 100644
--- a/gcc/tree-object-size.cc
+++ b/gcc/tree-object-size.cc
@@ -732,21 +732,13 @@ addr_object_size (struct object_size_info *osi,
const_tree ptr,
v = NULL_TREE;
break;
}
- /* if the ref is to a record or union type, but the type
- does not include a flexible array recursively, compute
- the object size directly. */
+ /* If the ref is to a record or union type, compute the
+ object size directly, regardless of whether the type
+ recursively includes a flexible array member. */
if (RECORD_OR_UNION_TYPE_P (TREE_TYPE (v)))
{
- if (!TYPE_INCLUDES_FLEXARRAY (TREE_TYPE (v)))
- {
- v = NULL_TREE;
- break;
- }
- else
- {
- v = TREE_OPERAND (v, 0);
- break;
- }
+ v = NULL_TREE;
+ break;
}
/* Now the ref is to an array type. */
gcc_assert (TREE_CODE (TREE_TYPE (v)) == ARRAY_TYPE);
--
2.47.3
