From patchwork Wed Jul 19 22:01:08 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Malcolm X-Patchwork-Id: 122847 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:c923:0:b0:3e4:2afc:c1 with SMTP id j3csp2731739vqt; Wed, 19 Jul 2023 15:01:56 -0700 (PDT) X-Google-Smtp-Source: APBJJlGL2l0wj8B0bLu3Kgz5nZhiXQQPknQhUMr+UASA2YGjxWt78ag0A0q19EIEqkmZiZ5S5hpm X-Received: by 2002:a17:906:9f25:b0:993:fb68:ed67 with SMTP id fy37-20020a1709069f2500b00993fb68ed67mr3051694ejc.24.1689804116158; Wed, 19 Jul 2023 15:01:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1689804116; cv=none; d=google.com; s=arc-20160816; b=l2/Y0gUq6S321Flxj+P+ATEssmNbG30fsLKTbQVJxAEdzP5cSibwMEZoxD7CgS6QhV zNbFb0SD787K01IEbxPgb1360Ihw66ff1Jm9uK3sxo2CZVDfU2hwNHzXE74NQj2t1ecj TosJs8QqkAsNFPrR/r5L1iRKyHCe/rw6VyfscKPcKK8T0hSNWGks8rFTSB7ilkjKsRBh W+Vn4yy1IhecFoQ5HevCDURXtBP5zgXxRR6z+TO56Hm3n3cPCWqwV+5bzsxrvrQFHvFd iZe/PBaAX6c1lEEWKlsXOVQCNSKF/RFiJCvP9RcpTK/OKIZRtPiNg99mn3pR/9oK6I1z TsiQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:message-id:date:subject:cc :to:dmarc-filter:delivered-to:dkim-signature:dkim-filter; bh=WJkZOzoFc6hXVoplnKkbXBjdosrdUISkuiCNlppr+bA=; fh=fa0YJSH7y4k0snNuxsKgOI6vGP7j2f0jR9F1WHC95UA=; b=wTjbJgnMJVB18JXIbZcoe+8499gJEFyrtICUCcd06GEJHbEU4SKtEkzFMQNXVlzQu4 F1NA60jZ6gn3kQOwHFIWgcTZKnChc+GzI9QZhIjMXNmXNo7tSiwgTKVvNnNxC9oKi3Qb iFk0709oo2ktpSQZ0vcZfaWZ9Tpu3TBqX7llwU71BaiyRIKMTforFPmAAWcBHIu+jors mhdDhGRLQ0ekBtJOjKxR320y0AJOBhErBa3tzk+3F6DQlImaU9VQ6160G8akYu3xiWds WUIz8wSF+ixkP95UgFNale/AfdJh/sOp8st2xcH5pRBztYu8W8BstPLX7dT0LTlOk8Q2 vx2Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b="jd/BW7m/"; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (server2.sourceware.org. [2620:52:3:1:0:246e:9693:128c]) by mx.google.com with ESMTPS id i13-20020a17090685cd00b009937e7c4e53si3298205ejy.343.2023.07.19.15.01.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Jul 2023 15:01:56 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) client-ip=2620:52:3:1:0:246e:9693:128c; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b="jd/BW7m/"; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id ACB8A3857020 for ; Wed, 19 Jul 2023 22:01:54 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org ACB8A3857020 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1689804114; bh=WJkZOzoFc6hXVoplnKkbXBjdosrdUISkuiCNlppr+bA=; h=To:Cc:Subject:Date:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:From:Reply-To:From; b=jd/BW7m/oCm7HEzFRbf97ZcEEVoIryOsVXIxDcWM2GAcoyo88CWOluHG2jAsRv5u6 VGiSXnxhJilOrBWL/cDN+l60MeI1oYc7bL5aCrkgQbxKsLuCj8sUivF9puaZwR+nTj viXXru90Vytpa1FfKUm1o98ixKB8IA2C4g9gejRU= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id E451D3858C78 for ; Wed, 19 Jul 2023 22:01:11 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org E451D3858C78 Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-674-TD4gAJAmN7CY-c48Kxpteg-1; Wed, 19 Jul 2023 18:01:09 -0400 X-MC-Unique: TD4gAJAmN7CY-c48Kxpteg-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id AAE95185A78B for ; Wed, 19 Jul 2023 22:01:09 +0000 (UTC) Received: from t14s.localdomain.com (unknown [10.22.8.62]) by smtp.corp.redhat.com (Postfix) with ESMTP id 856C040D283A; Wed, 19 Jul 2023 22:01:09 +0000 (UTC) To: gcc-patches@gcc.gnu.org Cc: David Malcolm Subject: [pushed] analyzer: fix ICE on division of tainted floating-point values [PR110700] Date: Wed, 19 Jul 2023 18:01:08 -0400 Message-Id: <20230719220108.255662-1-dmalcolm@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-11.4 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: David Malcolm via Gcc-patches From: David Malcolm Reply-To: David Malcolm Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1771888041048834293 X-GMAIL-MSGID: 1771888041048834293 Successfully bootstrapped & regrtested on x86_64-pc-linux-gnu. Pushed to trunk as r14-2658-gb86c0fe327a519. gcc/analyzer/ChangeLog: PR analyzer/110700 * region-model-manager.cc (region_model_manager::get_or_create_int_cst): Assert that we have an integral or pointer type. * sm-taint.cc (taint_state_machine::check_for_tainted_divisor): Don't check non-integral types. gcc/testsuite/ChangeLog: PR analyzer/110700 * gcc.dg/analyzer/taint-divisor-2.c: New test. --- gcc/analyzer/region-model-manager.cc | 1 + gcc/analyzer/sm-taint.cc | 6 ++++++ gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c | 13 +++++++++++++ 3 files changed, 20 insertions(+) create mode 100644 gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc index 4f11ef4bd29..e43b99ae0ba 100644 --- a/gcc/analyzer/region-model-manager.cc +++ b/gcc/analyzer/region-model-manager.cc @@ -234,6 +234,7 @@ region_model_manager::get_or_create_int_cst (tree type, const poly_wide_int_ref &cst) { gcc_assert (type); + gcc_assert (INTEGRAL_TYPE_P (type) || POINTER_TYPE_P (type)); tree tree_cst = wide_int_to_tree (type, cst); return get_or_create_constant_svalue (tree_cst); } diff --git a/gcc/analyzer/sm-taint.cc b/gcc/analyzer/sm-taint.cc index 6d28d1f6f65..09c1e9368cd 100644 --- a/gcc/analyzer/sm-taint.cc +++ b/gcc/analyzer/sm-taint.cc @@ -1344,6 +1344,12 @@ taint_state_machine::check_for_tainted_divisor (sm_context *sm_ctxt, return; tree divisor_expr = gimple_assign_rhs2 (assign);; + + /* Until we track conditions on floating point values, we can't check to + see if they've been checked against zero. */ + if (!INTEGRAL_TYPE_P (TREE_TYPE (divisor_expr))) + return; + const svalue *divisor_sval = old_model->get_rvalue (divisor_expr, NULL); state_t state = sm_ctxt->get_state (assign, divisor_sval); diff --git a/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c b/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c new file mode 100644 index 00000000000..de9a1cb3a46 --- /dev/null +++ b/gcc/testsuite/gcc.dg/analyzer/taint-divisor-2.c @@ -0,0 +1,13 @@ +// TODO: remove need for this option: +/* { dg-additional-options "-fanalyzer-checker=taint" } */ + +#include "analyzer-decls.h" + +__attribute__ ((tainted_args)) +double pr110700 (double x, double y) +{ + /* Ideally we'd complain here with -Wanalyzer-tainted-divisor, but + until we track conditions on floating point values, we can't check to + see if they've been checked against zero. */ + return x / y; +}