From patchwork Tue Mar 14 22:50:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marek Polacek X-Patchwork-Id: 69875 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp2023033wrd; Tue, 14 Mar 2023 15:51:21 -0700 (PDT) X-Google-Smtp-Source: AK7set8wEiVakgJmNU8ug70tcxchKvIAAs/h3KfwllErHzt1KRC8ngpTByh9SLHHw5XMEpg+oktf X-Received: by 2002:aa7:db8a:0:b0:4fb:d10e:d9b4 with SMTP id u10-20020aa7db8a000000b004fbd10ed9b4mr617724edt.16.1678834281360; Tue, 14 Mar 2023 15:51:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1678834281; cv=none; d=google.com; s=arc-20160816; b=JCvikvQSd9Hs/Ge6Y+DGeg2toilWNCGLKBs5WMmtdtdl637+EF4X4XlSd6DnjpGY8P TYlR494RpfAUJ3Wq/+mWIomN+ldrj2fVLDF39zX6A9WoaXXYdxeNWtZg8DOuID+1FUUW X5fLOUN3e47LQu1fwpKTyn1JWLvZhjwJw6ctCqHlcv5ZSaVWS7OmqDGkGfBMXbNQn+Wq OnNZtnqlMf/WJ4fVrf1JImJhWn6tQedMrQGxb0HBzJ/7zmhWRLIM24eXAuOvuy94GALh kpaY6oiH5GAukUsSaevscBH+X79slGNg+Fd1Wlckv37PI1ktVnAgnyFZ+R8d/3RD9uuf U4GQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:message-id:date:subject:to :dmarc-filter:delivered-to:dkim-signature:dkim-filter; bh=KKpZFfd/bWqEvBuNUNNDc34684LGRPPcR1mRHoyunqs=; b=fsMjaLqDNE4zy4TYwFkmH+IvNzI+je3ara6Gazbqv6vZMcnqnkiibvntzzSdfcGw27 2JuSYl4duOYkHC5EdCFTsdFcYLQhtjJJI8Y7Yfjb2dOunBJaBkBaxCemdpXlt12L7GUW Hy04ZsM07vbzNuhf+0dswPQ8bTtpnTqZmsN+Z5me6pxZl9+HV/X/lA2vGNAzm1m/q9i9 UL1wFF8YAePp1DL6iwc+Sb7z6WyLZGu2iEB0BvcnXNmQhdOHQBK+Gns24HWcydzCbe+K PPoHsDWKLlE/FqjkZfFvgj1a7ltPpwX7TFshS778bihI5zYy2OddFSU1kTv+FnkQ0lJn mjLQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=cw3lj5hS; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from sourceware.org (ip-8-43-85-97.sourceware.org. [8.43.85.97]) by mx.google.com with ESMTPS id w3-20020a056402128300b004fcd1adbb05si3759629edv.210.2023.03.14.15.51.21 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Mar 2023 15:51:21 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) client-ip=8.43.85.97; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=cw3lj5hS; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 8.43.85.97 as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 57EE03858284 for ; Tue, 14 Mar 2023 22:51:20 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 57EE03858284 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1678834280; bh=KKpZFfd/bWqEvBuNUNNDc34684LGRPPcR1mRHoyunqs=; h=To:Subject:Date:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:From; b=cw3lj5hSXDpQdaI1tXfl/Ootx1U5O3Q6coS3PGWaJ3bsIZzIrcZKv+yn99gKDykNb wDoMEiDouTRXwm1c8mVPkjW7DHTGllpnd2l32s4eX/IUZBjA1bSV0lPQw7ni5wCB4W cPvw2ytUvsWwQMgiLi8oIi7mrROKZsR+ssQZI27o= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id 14AC33858D33 for ; Tue, 14 Mar 2023 22:50:36 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 14AC33858D33 Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-172-M_HfaUuRPTW84sajJgi0sg-1; Tue, 14 Mar 2023 18:50:34 -0400 X-MC-Unique: M_HfaUuRPTW84sajJgi0sg-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 7669A886462 for ; Tue, 14 Mar 2023 22:50:34 +0000 (UTC) Received: from pdp-11.redhat.com (unknown [10.22.10.74]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5B5BB202701E for ; Tue, 14 Mar 2023 22:50:34 +0000 (UTC) To: GCC Patches Subject: [PATCH] sanitizer: missing signed integer overflow errors [PR109107] Date: Tue, 14 Mar 2023 18:50:26 -0400 Message-Id: <20230314225026.163717-1-polacek@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.4 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-12.1 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Marek Polacek via Gcc-patches From: Marek Polacek Reply-To: Marek Polacek Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1760385335501979983?= X-GMAIL-MSGID: =?utf-8?q?1760385335501979983?= Here we're failing to detect a signed overflow with -O because match.pd, since r8-1516, transforms c = (a + 1) - (int) (short int) b; into c = (int) ((unsigned int) a + 4294946117); wrongly eliding the overflow. This kind of problems is usually avoided by using TYPE_OVERFLOW_SANITIZED in the appropriate place. The first match.pd hunk in the patch fixes it. I've constructed a testcase for each of the surrounding cases as well. Then I noticed that fold_binary_loc/associate has the same problem, so I've added a TYPE_OVERFLOW_SANITIZED there as well (it may be too coarse, sorry). Then I found yet another problem, but instead of fixing it now I've opened 109134. I could probably go on and find a dozen more. Is this worth doing? Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk? PR sanitizer/109107 gcc/ChangeLog: * fold-const.cc (fold_binary_loc): Use TYPE_OVERFLOW_SANITIZED when associating. * match.pd: Use TYPE_OVERFLOW_SANITIZED. gcc/testsuite/ChangeLog: * c-c++-common/ubsan/pr109107-2.c: New test. * c-c++-common/ubsan/pr109107-3.c: New test. * c-c++-common/ubsan/pr109107-4.c: New test. * c-c++-common/ubsan/pr109107.c: New test. --- gcc/fold-const.cc | 3 ++- gcc/match.pd | 6 ++--- gcc/testsuite/c-c++-common/ubsan/pr109107-2.c | 24 ++++++++++++++++++ gcc/testsuite/c-c++-common/ubsan/pr109107-3.c | 25 +++++++++++++++++++ gcc/testsuite/c-c++-common/ubsan/pr109107-4.c | 24 ++++++++++++++++++ gcc/testsuite/c-c++-common/ubsan/pr109107.c | 23 +++++++++++++++++ 6 files changed, 101 insertions(+), 4 deletions(-) create mode 100644 gcc/testsuite/c-c++-common/ubsan/pr109107-2.c create mode 100644 gcc/testsuite/c-c++-common/ubsan/pr109107-3.c create mode 100644 gcc/testsuite/c-c++-common/ubsan/pr109107-4.c create mode 100644 gcc/testsuite/c-c++-common/ubsan/pr109107.c base-commit: 9e44a9932c11f028269f3aa7e3031e703d151b0b diff --git a/gcc/fold-const.cc b/gcc/fold-const.cc index 02a24c5fe65..8d3308a34e9 100644 --- a/gcc/fold-const.cc +++ b/gcc/fold-const.cc @@ -11319,7 +11319,8 @@ fold_binary_loc (location_t loc, enum tree_code code, tree type, And, we need to make sure type is not saturating. */ if ((! FLOAT_TYPE_P (type) || flag_associative_math) - && !TYPE_SATURATING (type)) + && !TYPE_SATURATING (type) + && !TYPE_OVERFLOW_SANITIZED (type)) { tree var0, minus_var0, con0, minus_con0, lit0, minus_lit0; tree var1, minus_var1, con1, minus_con1, lit1, minus_lit1; diff --git a/gcc/match.pd b/gcc/match.pd index e352bd422f5..98bca9ea388 100644 --- a/gcc/match.pd +++ b/gcc/match.pd @@ -2933,7 +2933,7 @@ DEFINE_INT_AND_FLOAT_ROUND_FN (RINT) /* If the constant operation overflows we cannot do the transform directly as we would introduce undefined overflow, for example with (a - 1) + INT_MIN. */ - (if (types_match (type, @0)) + (if (types_match (type, @0) && !TYPE_OVERFLOW_SANITIZED (type)) (with { tree cst = const_binop (outer_op == inner_op ? PLUS_EXPR : MINUS_EXPR, type, @1, @2); } @@ -2964,7 +2964,7 @@ DEFINE_INT_AND_FLOAT_ROUND_FN (RINT) (if (!ANY_INTEGRAL_TYPE_P (TREE_TYPE (@0)) || TYPE_OVERFLOW_WRAPS (TREE_TYPE (@0))) (view_convert (minus (outer_op @1 (view_convert @2)) @0)) - (if (types_match (type, @0)) + (if (types_match (type, @0) && !TYPE_OVERFLOW_SANITIZED (type)) (with { tree cst = const_binop (outer_op, type, @1, @2); } (if (cst && !TREE_OVERFLOW (cst)) (minus { cst; } @0)))))))) @@ -2983,7 +2983,7 @@ DEFINE_INT_AND_FLOAT_ROUND_FN (RINT) (if (!ANY_INTEGRAL_TYPE_P (TREE_TYPE (@0)) || TYPE_OVERFLOW_WRAPS (TREE_TYPE (@0))) (view_convert (plus @0 (minus (view_convert @1) @2))) - (if (types_match (type, @0)) + (if (types_match (type, @0) && !TYPE_OVERFLOW_SANITIZED (type)) (with { tree cst = const_binop (MINUS_EXPR, type, @1, @2); } (if (cst && !TREE_OVERFLOW (cst)) (plus { cst; } @0))))))) diff --git a/gcc/testsuite/c-c++-common/ubsan/pr109107-2.c b/gcc/testsuite/c-c++-common/ubsan/pr109107-2.c new file mode 100644 index 00000000000..eb440b58dd8 --- /dev/null +++ b/gcc/testsuite/c-c++-common/ubsan/pr109107-2.c @@ -0,0 +1,24 @@ +/* PR sanitizer/109107 */ +/* { dg-do run { target int32 } } */ +/* { dg-options "-fsanitize=signed-integer-overflow" } */ + +#define INT_MIN (-__INT_MAX__ - 1) +int a = INT_MIN; +const int b = 676540; + +__attribute__((noipa)) int +foo () +{ + int c = a - 1 + (int) (short) b; + return c; +} + +int +main () +{ + foo (); + return 0; +} + +/* { dg-output "signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'\[^\n\r]*(\n|\r\n|\r)" } */ +/* { dg-output "\[^\n\r]*signed integer overflow: 2147483647 \\+ 21180 cannot be represented in type 'int'" } */ diff --git a/gcc/testsuite/c-c++-common/ubsan/pr109107-3.c b/gcc/testsuite/c-c++-common/ubsan/pr109107-3.c new file mode 100644 index 00000000000..fa074e7426a --- /dev/null +++ b/gcc/testsuite/c-c++-common/ubsan/pr109107-3.c @@ -0,0 +1,25 @@ +/* PR sanitizer/109107 */ +/* { dg-do run { target int32 } } */ +/* { dg-options "-fsanitize=signed-integer-overflow" } */ + +#define INT_MIN (-__INT_MAX__ - 1) +const int a = INT_MIN; +const int b = 40; +int d = 1; + +__attribute__((noipa)) int +foo () +{ + int c = a - d + (int) (short) b; + return c; +} + +int +main () +{ + foo (); + return 0; +} + +/* { dg-output "signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'\[^\n\r]*(\n|\r\n|\r)" } */ +/* { dg-output "\[^\n\r]*signed integer overflow: 2147483647 \\+ 40 cannot be represented in type 'int'" } */ diff --git a/gcc/testsuite/c-c++-common/ubsan/pr109107-4.c b/gcc/testsuite/c-c++-common/ubsan/pr109107-4.c new file mode 100644 index 00000000000..b0ac987a15b --- /dev/null +++ b/gcc/testsuite/c-c++-common/ubsan/pr109107-4.c @@ -0,0 +1,24 @@ +/* PR sanitizer/109107 */ +/* { dg-do run { target int32 } } */ +/* { dg-options "-fsanitize=signed-integer-overflow" } */ + +#define INT_MIN (-__INT_MAX__ - 1) +const int x = INT_MIN; +const int y = -2; +int a = -3; + +__attribute__((noipa)) int +foo () +{ + int c = x - (y - a); + return c; +} + +int +main () +{ + foo (); + return 0; +} + +/* { dg-output "signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'" } */ diff --git a/gcc/testsuite/c-c++-common/ubsan/pr109107.c b/gcc/testsuite/c-c++-common/ubsan/pr109107.c new file mode 100644 index 00000000000..ca4dd0e3943 --- /dev/null +++ b/gcc/testsuite/c-c++-common/ubsan/pr109107.c @@ -0,0 +1,23 @@ +/* PR sanitizer/109107 */ +/* { dg-do run { target int32 } } */ +/* { dg-options "-fsanitize=signed-integer-overflow" } */ + +#define INT_MIN (-__INT_MAX__ - 1) +int a = INT_MIN; +const int b = 676540; + +__attribute__((noipa)) int +foo () +{ + int c = a + 1 - (int) (short) b; + return c; +} + +int +main () +{ + foo (); + return 0; +} + +/* { dg-output "signed integer overflow: -2147483647 - 21180 cannot be represented in type 'int'" } */