<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 12/19/2017 8:51 PM, Mahesh Attarde
via cfe-dev wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAHFX7s6uaD7hHN29+CJ_gb2zU0o6X8+5N35oKCDY48fOrRGvRw@mail.gmail.com">
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>
<div>
<div>Hi<br>
</div>
I am working on analyzing arrays for dimensions and
inferring iteration space.<br>
</div>
While going through this i found example<br>
<br>
<div style="color:rgb(0,0,0);background-color:rgb(255,255,254);font-family:Fira Mono;font-weight:normal;font-size:14px;line-height:19px;white-space:pre"><div><span style="color:rgb(0,0,255)">int</span><span style="color:rgb(0,0,0)"> funct(</span><span style="color:rgb(0,0,255)"></span><span style="color:rgb(0,0,0)">){</span></div><div><span style="color:rgb(0,0,0)"> </span><span style="color:rgb(0,0,255)">int</span><span style="color:rgb(0,0,0)"> a[</span><span style="color:rgb(9,136,90)">6</span><span style="color:rgb(0,0,0)">][</span><span style="color:rgb(9,136,90)">6</span><span style="color:rgb(0,0,0)">][</span><span style="color:rgb(9,136,90)">6</span><span style="color:rgb(0,0,0)">];</span></div><div><span style="color:rgb(0,0,0)"> </span><span style="color:rgb(0,0,255)">return</span><span style="color:rgb(0,0,0)"> a[</span><span style="color:rgb(9,136,90)">8</span><span style="color:rgb(0,0,0)">][</span><span style="color:rgb(9,136,90)">0</span><span style="color:rgb(0,0,0)">][</span><span style="color:rgb(9,136,90)">0</span><span style="color:rgb(0,0,0)">];</span></div><div><span style="color:rgb(0,0,0)">}</span></div></div>
<br>
</div>
<div><a href="https://godbolt.org/g/S9pKqq"
moz-do-not-send="true">https://godbolt.org/g/S9pKqq</a><br>
</div>
<div> <br>
</div>
Compiler did not warn about extended index in first
dimension. Considering arrays are decayed<br>
</div>
into pointer, Will issuing this as error be false
positive?<br>
</div>
</div>
</div>
</div>
</blockquote>
<br>
No; a[8] is equivalent to *(a+8), and "a+8" is undefined behavior
because it points outside the array. -fsanitize=undefined will
catch this at runtime.<br>
<br>
<blockquote type="cite"
cite="mid:CAHFX7s6uaD7hHN29+CJ_gb2zU0o6X8+5N35oKCDY48fOrRGvRw@mail.gmail.com">
<div dir="ltr">
<div>
<div>By looking at this it looks like easy problem to solve
at AST level. What is challenge in this analysis?<br>
</div>
</div>
</div>
</blockquote>
<br>
Probably just an oversight in the checking code. Briefly looking at
it, it looks like there's a missing call to Sema::CheckArrayAccess?<br>
<br>
-Eli<br>
<pre class="moz-signature" cols="72">--
Employee of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a Linux Foundation Collaborative Project</pre>
</body>
</html>