FreeChainXenon/gcc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

analyzer: fix ignored constraints involving casts [PR113619]

Browse source 
gcc/analyzer/ChangeLog:
	PR analyzer/113619
	* region-model.cc (region_model::eval_condition): Fix
	cast-handling from r14-3632-ge7b267444045c5 so that if those give
	an unknown result, we continue trying the constraint manager.

gcc/testsuite/ChangeLog:
	PR analyzer/113619
	* c-c++-common/analyzer/taint-divisor-pr113619.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>
This commit is contained in:
David Malcolm 2024-03-21 17:48:38 -04:00
parent 48d4920051
commit 7a5a4a4467
2 changed files with 46 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
gcc/analyzer/region-model.cc
View file

@ -4704,17 +4704,27 @@ region_model::eval_condition (const svalue *lhs,
if (lhs_un_op && CONVERT_EXPR_CODE_P (lhs_un_op->get_op ())
&& rhs_un_op && CONVERT_EXPR_CODE_P (rhs_un_op->get_op ())
&& lhs_type == rhs_type)
return eval_condition (lhs_un_op->get_arg (),
op,
rhs_un_op->get_arg ());
{
tristate res = eval_condition (lhs_un_op->get_arg (),
op,
rhs_un_op->get_arg ());
if (res.is_known ())
return res;
}
else if (lhs_un_op && CONVERT_EXPR_CODE_P (lhs_un_op->get_op ())
&& lhs_type == rhs_type)
return eval_condition (lhs_un_op->get_arg (), op, rhs);
{
tristate res = eval_condition (lhs_un_op->get_arg (), op, rhs);
if (res.is_known ())
return res;
}
else if (rhs_un_op && CONVERT_EXPR_CODE_P (rhs_un_op->get_op ())
&& lhs_type == rhs_type)
return eval_condition (lhs, op, rhs_un_op->get_arg ());
{
tristate res = eval_condition (lhs, op, rhs_un_op->get_arg ());
if (res.is_known ())
return res;
}
}
/* Otherwise, try constraints.

29
gcc/testsuite/c-c++-common/analyzer/taint-divisor-pr113619.c Normal file
View file

@ -0,0 +1,29 @@
/* Reduced from false positive in Linux kernel's fs/ceph/ioctl.c: */
__extension__ typedef unsigned long long __u64;
struct ceph_ioctl_layout
{
__u64 stripe_unit, object_size;
};
static long
__validate_layout(struct ceph_ioctl_layout* l)
{
if ((l->object_size & ~(~(((1UL) << 12) - 1))) ||
(l->stripe_unit & ~(~(((1UL) << 12) - 1))) ||
((unsigned)l->stripe_unit != 0 &&
((unsigned)l->object_size % (unsigned)l->stripe_unit))) /* { dg-bogus "use of attacker-controlled value 'l.stripe_unit' as divisor without checking for zero" "PR analyzer/113619" } */
return -22;
return 0;
}
long
__attribute__((tainted_args))
ceph_ioctl_set_layout_policy(struct ceph_ioctl_layout l)
{
int err;
err = __validate_layout(&l);
if (err)
return err;
return err;
}