Module Name: src
Committed By: rillig
Date: Sun Oct 31 23:15:44 UTC 2021
Modified Files:
src/tests/usr.bin/xlint/lint1: msg_348.c msg_348.exp
src/usr.bin/xlint/lint1: tree.c
Log Message:
lint: fix invalid memory access in array[enum] check
Lint checks whether in an expression 'array[enum]', the array size
matches the value of the maximum enum constant.
The previous tests for this check were missing the case where an enum
name was explicitly cast to an integer type and then used as an array
index. In this situation, the resulting type of the array index is a
plain 'int' without any information about its previous 'enum' history.
An entirely different case is when the 'enum' is implicitly converted to
an integer type, as in the test color_name_too_many. There, for the
final type of the array index, rn->tn_type->t_is_enum is true, which
means that rn->tn_type->t_enum is properly filled.
The bug was a simple typo, I had forgotten a tn_left indirection, which
is necessary to get the type before the implicit conversion.
Found and reported by Christos, triggered by src/lib/libperfuse/ops.c
1.89 line 1226 expression 'VTTOIF(vap->va_type)'.
To generate a diff of this commit:
cvs rdiff -u -r1.1 -r1.2 src/tests/usr.bin/xlint/lint1/msg_348.c \
src/tests/usr.bin/xlint/lint1/msg_348.exp
cvs rdiff -u -r1.387 -r1.388 src/usr.bin/xlint/lint1/tree.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/tests/usr.bin/xlint/lint1/msg_348.c
diff -u src/tests/usr.bin/xlint/lint1/msg_348.c:1.1 src/tests/usr.bin/xlint/lint1/msg_348.c:1.2
--- src/tests/usr.bin/xlint/lint1/msg_348.c:1.1 Sat Oct 30 22:04:42 2021
+++ src/tests/usr.bin/xlint/lint1/msg_348.c Sun Oct 31 23:15:44 2021
@@ -1,4 +1,4 @@
-/* $NetBSD: msg_348.c,v 1.1 2021/10/30 22:04:42 rillig Exp $ */
+/* $NetBSD: msg_348.c,v 1.2 2021/10/31 23:15:44 rillig Exp $ */
# 3 "msg_348.c"
// Test for message 348: maximum value %d of '%s' does not match maximum array index %d [348]
@@ -72,6 +72,17 @@ color_name_cast_from_int(int c)
}
const char *
+color_name_explicit_cast_to_int(enum color color)
+{
+ static const char *name[] = {
+ "red",
+ "green",
+ };
+ /* expect+1: warning: maximum value 2 of 'enum color' does not match maximum array index 1 [348] */
+ return name[(int)color];
+}
+
+const char *
color_name_computed_pointer(enum color color, const char *name)
{
/* No warning since 'name' is not an array. */
Index: src/tests/usr.bin/xlint/lint1/msg_348.exp
diff -u src/tests/usr.bin/xlint/lint1/msg_348.exp:1.1 src/tests/usr.bin/xlint/lint1/msg_348.exp:1.2
--- src/tests/usr.bin/xlint/lint1/msg_348.exp:1.1 Sat Oct 30 22:04:42 2021
+++ src/tests/usr.bin/xlint/lint1/msg_348.exp Sun Oct 31 23:15:44 2021
@@ -1,4 +1,5 @@
msg_348.c(32): warning: maximum value 2 of 'enum color' does not match maximum array index 1 [348]
msg_348.c(45): warning: maximum value 2 of 'enum color' does not match maximum array index 3 [348]
-msg_348.c(92): warning: integral constant too large [56]
-msg_348.c(94): warning: integral constant too large [56]
+msg_348.c(82): warning: maximum value 2 of 'enum color' does not match maximum array index 1 [348]
+msg_348.c(103): warning: integral constant too large [56]
+msg_348.c(105): warning: integral constant too large [56]
Index: src/usr.bin/xlint/lint1/tree.c
diff -u src/usr.bin/xlint/lint1/tree.c:1.387 src/usr.bin/xlint/lint1/tree.c:1.388
--- src/usr.bin/xlint/lint1/tree.c:1.387 Sun Oct 31 16:42:16 2021
+++ src/usr.bin/xlint/lint1/tree.c Sun Oct 31 23:15:44 2021
@@ -1,4 +1,4 @@
-/* $NetBSD: tree.c,v 1.387 2021/10/31 16:42:16 christos Exp $ */
+/* $NetBSD: tree.c,v 1.388 2021/10/31 23:15:44 rillig Exp $ */
/*
* Copyright (c) 1994, 1995 Jochen Pohl
@@ -37,7 +37,7 @@
#include <sys/cdefs.h>
#if defined(__RCSID) && !defined(lint)
-__RCSID("$NetBSD: tree.c,v 1.387 2021/10/31 16:42:16 christos Exp $");
+__RCSID("$NetBSD: tree.c,v 1.388 2021/10/31 23:15:44 rillig Exp $");
#endif
#include <float.h>
@@ -1793,12 +1793,9 @@ check_enum_array_index(const tnode_t *ln
return;
if (rn->tn_left->tn_type->t_tspec != ENUM)
return;
- // XXX: why?
- if (rn->tn_type->t_enum == NULL)
- return;
max_enum_value = INT_MIN;
- ec = rn->tn_type->t_enum->en_first_enumerator;
+ ec = rn->tn_left->tn_type->t_enum->en_first_enumerator;
for (; ec != NULL; ec = ec->s_next) {
int64_t ev = ec->s_value.v_quad;
lint_assert(INT_MIN <= ev && ev <= INT_MAX);
@@ -1811,7 +1808,8 @@ check_enum_array_index(const tnode_t *ln
return;
/* maximum value %d of '%s' does not match maximum array index %d */
- warning(348, max_enum_value, type_name(rn->tn_type), max_array_index);
+ warning(348, max_enum_value, type_name(rn->tn_left->tn_type),
+ max_array_index);
}
/*
