From patchwork Mon May 16 09:16:16 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richard Biener X-Patchwork-Id: 54026 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 8DB14385780F for ; Mon, 16 May 2022 09:24:57 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 8DB14385780F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1652693097; bh=762mO84rsa2CngJrbgUCf376jeqNE+KfI2+PGpF9bJ8=; h=Date:To:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=eBZ1dwHttCvS6SYcEnPkh9y4b7QZwVPS6J/bex1+yxYm+wzhi5OJKmwKDHOch9tGW +bAXDuf6NmWLGfV0nbGcBOD5eFTDeyW0KxuT2pu3E0wgpe+VO5OUC0NdDhZz6RhhKp h6mMCFl0piaxDaYTGM3UzPyvOOaCVyWldlougioA= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by sourceware.org (Postfix) with ESMTPS id B60893857831 for ; Mon, 16 May 2022 09:16:17 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org B60893857831 Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 95DDD1FAF7; Mon, 16 May 2022 09:16:16 +0000 (UTC) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 7D3DF13ADC; Mon, 16 May 2022 09:16:16 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id 2kKBHWAWgmIVCQAAMHmgww (envelope-from ); Mon, 16 May 2022 09:16:16 +0000 Date: Mon, 16 May 2022 11:16:16 +0200 (CEST) To: gcc-patches@gcc.gnu.org Subject: [PATCH] middle-end/105604 - snprintf dianostics and non-constant sizes/offsets MIME-Version: 1.0 Message-Id: <20220516091616.7D3DF13ADC@imap2.suse-dmz.suse.de> X-Spam-Status: No, score=-11.7 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Richard Biener via Gcc-patches From: Richard Biener Reply-To: Richard Biener Cc: msebor@redhat.com Errors-To: gcc-patches-bounces+patchwork=sourceware.org@gcc.gnu.org Sender: "Gcc-patches" The following tries to correct get_origin_and_offset_r not handling non-constant sizes of array elements in ARRAY_REFs and non-constant offsets of COMPONENT_REFs. It isn't exactly clear how such failures should be treated in this API and existing handling isn't consistent here either. The following applies two different variants, treating non-constant array sizes like non-constant array indices and treating non-constant offsets of COMPONENT_REFs by terminating the recursion (not sure what that means to the callers). Basically the code failed to use component_ref_field_offset and array_ref_element_size and instead relies on inappropriate helpers (that shouldn't exist in the first place ...). The code is also not safe-guarded against overflows in the final offset/size computations but I'm not trying to rectify that. Martin - can you comment on how the API should handle such situations? Bootstrapped and tested on x86_64-unknown-linux-gnu. OK for trunk and branches? Thanks, Richard. 2022-05-16 Richard Biener PR middle-end/105604 * gimple-ssa-sprintf.cc (get_origin_and_offset_r): Handle non-constant ARRAY_REF element size and non-constant COMPONENT_REF field offset. * gcc.dg/torture/pr105604.c: New testcase. --- gcc/gimple-ssa-sprintf.cc | 14 +++++++++++--- gcc/testsuite/gcc.dg/torture/pr105604.c | 24 ++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 3 deletions(-) create mode 100644 gcc/testsuite/gcc.dg/torture/pr105604.c diff --git a/gcc/gimple-ssa-sprintf.cc b/gcc/gimple-ssa-sprintf.cc index c93f12f90b5..14e215ce69c 100644 --- a/gcc/gimple-ssa-sprintf.cc +++ b/gcc/gimple-ssa-sprintf.cc @@ -2312,14 +2312,16 @@ get_origin_and_offset_r (tree x, HOST_WIDE_INT *fldoff, HOST_WIDE_INT *fldsize, HOST_WIDE_INT idx = (tree_fits_uhwi_p (offset) ? tree_to_uhwi (offset) : HOST_WIDE_INT_MAX); + tree elsz = array_ref_element_size (x); tree eltype = TREE_TYPE (x); if (TREE_CODE (eltype) == INTEGER_TYPE) { if (off) *off = idx; } - else if (idx < HOST_WIDE_INT_MAX) - *fldoff += idx * int_size_in_bytes (eltype); + else if (idx < HOST_WIDE_INT_MAX + && tree_fits_shwi_p (elsz)) + *fldoff += idx * tree_to_shwi (elsz); else *fldoff = idx; @@ -2350,8 +2352,14 @@ get_origin_and_offset_r (tree x, HOST_WIDE_INT *fldoff, HOST_WIDE_INT *fldsize, case COMPONENT_REF: { + tree foff = component_ref_field_offset (x); tree fld = TREE_OPERAND (x, 1); - *fldoff += int_byte_position (fld); + if (!tree_fits_shwi_p (foff) + || !tree_fits_shwi_p (DECL_FIELD_BIT_OFFSET (fld))) + return x; + *fldoff += (tree_to_shwi (foff) + + (tree_to_shwi (DECL_FIELD_BIT_OFFSET (fld)) + / BITS_PER_UNIT)); get_origin_and_offset_r (fld, fldoff, fldsize, off); x = TREE_OPERAND (x, 0); diff --git a/gcc/testsuite/gcc.dg/torture/pr105604.c b/gcc/testsuite/gcc.dg/torture/pr105604.c new file mode 100644 index 00000000000..b002251df10 --- /dev/null +++ b/gcc/testsuite/gcc.dg/torture/pr105604.c @@ -0,0 +1,24 @@ +/* { dg-do compile } */ +/* { dg-additional-options "-Wall" } */ + +struct { + long users; + long size; + char *data; +} * main_trans; +void *main___trans_tmp_1; +int sprintf(char *, char *, ...); +int main() { + int users = 0; + struct { + long users; + long size; + char *data; + int links[users]; + char buf[]; + } *trans = trans; + trans->data = trans->buf; + main___trans_tmp_1 = trans; + main_trans = main___trans_tmp_1; + sprintf(main_trans->data, "test"); +}