diff mbox series

[committed] analyzer: fix ICE on realloc of zeroed memory [PR104062]

Message ID 20220118205831.2146410-1-dmalcolm@redhat.com
State Committed
Commit 79e746bb05e432dcd1c18161469272d67c33d79d
Headers
Series [committed] analyzer: fix ICE on realloc of zeroed memory [PR104062] |

Commit Message

David Malcolm Jan. 18, 2022, 8:58 p.m. UTC 
  Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu.
Pushed to trunk as r12-6699-g79e746bb05e432dcd1c18161469272d67c33d79d.

gcc/analyzer/ChangeLog:
	PR analyzer/104062
	* region-model-manager.cc
	(region_model_manager::maybe_fold_sub_svalue): Avoid casting to
	NULL type when folding access to repeated svalue.

gcc/testsuite/ChangeLog:
	PR analyzer/104062
	* gcc.dg/analyzer/pr104062.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>
---
 gcc/analyzer/region-model-manager.cc     |  3 ++-
 gcc/testsuite/gcc.dg/analyzer/pr104062.c | 13 +++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/pr104062.c
diff mbox series

Patch

diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc
index 903cdfde91d..9d4f5952ef3 100644
--- a/gcc/analyzer/region-model-manager.cc
+++ b/gcc/analyzer/region-model-manager.cc
@@ -794,7 +794,8 @@  region_model_manager::maybe_fold_sub_svalue (tree type,
 
   if (const repeated_svalue *repeated_sval
 	= parent_svalue->dyn_cast_repeated_svalue ())
-    return get_or_create_cast (type, repeated_sval->get_inner_svalue ());
+    if (type)
+      return get_or_create_cast (type, repeated_sval->get_inner_svalue ());
 
   return NULL;
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr104062.c b/gcc/testsuite/gcc.dg/analyzer/pr104062.c
new file mode 100644
index 00000000000..7129c27f60b
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/pr104062.c
@@ -0,0 +1,13 @@ 
+void *
+calloc (__SIZE_TYPE__, __SIZE_TYPE__);
+
+void *
+realloc (void *, __SIZE_TYPE__);
+
+void
+foo (void)
+{
+  int *ap5 = calloc (4, sizeof *ap5);
+  int *ap7 = realloc (ap5, sizeof *ap5);
+} /* { dg-warning "leak of 'ap5'" "leak of ap5" } */
+/* { dg-warning "leak of 'ap7'" "leak of ap7" { target *-*-* } .-1 } */