<html>
    <head>
      <base href="http://llvm.org/bugs/" />
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW --- - warn on (sometimes?) dereference of one-past-end pointer"
   href="http://llvm.org/bugs/show_bug.cgi?id=15535">15535</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>warn on (sometimes?) dereference of one-past-end pointer
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>clang
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>unspecified
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>PC
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>Linux
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>NEW
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>enhancement
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>P
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>-New Bugs
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>unassignedclangbugs@nondot.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>nicholas@mxc.ca
          </td>
        </tr>

        <tr>
          <th>CC</th>
          <td>llvmbugs@cs.uiuc.edu
          </td>
        </tr>

        <tr>
          <th>Classification</th>
          <td>Unclassified
          </td>
        </tr></table>
      <p>
        <div>
        <pre>I'd like something like -Wuninitialized/-Wsometimes-uninitialized but which
keeps track of pointers that are known to point to one-past-the-end of an
array, and warn when dereferenced.

For motivation, see the example code in <a class="bz_bug_link 
          bz_status_RESOLVED  bz_closed"
   title="RESOLVED INVALID - Loop Optimizer Problems"
   href="show_bug.cgi?id=15522">bug 15522</a> which clang issues no
warnings for. If the program instead asked for "long *pk = &buf[3];" clang
would issue a warning with -Warray-bounds because that's two past the end of
the array and consequently always invalid.

  char buf[2];
  char *p = &buf[2];
  *p = '\0';  // please warn here.

Also, using the same logic from the -Wsometimes-uninitialized flag, I'd also
like this:

  char buf[2];
  char *p = &buf[2];
  if (condition) {
    *p = '\0';  // please warn in here as well.
  }</pre>
        </div>
      </p>
      <hr>
      <span>You are receiving this mail because:</span>
      
      <ul>
          <li>You are on the CC list for the bug.</li>
      </ul>
    </body>
</html>