<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Clang SA false positive with copy after pointer conversion."
href="https://bugs.llvm.org/show_bug.cgi?id=39978">39978</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Clang SA false positive with copy after pointer conversion.
</td>
</tr>
<tr>
<th>Product</th>
<td>clang
</td>
</tr>
<tr>
<th>Version</th>
<td>4.0
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Static Analyzer
</td>
</tr>
<tr>
<th>Assignee</th>
<td>dcoughlin@apple.com
</td>
</tr>
<tr>
<th>Reporter</th>
<td>rvijayc@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>dcoughlin@apple.com, llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=21215" name="attach_21215" title="Example file that demonstrates Clang SA false-positive.">attachment 21215</a> <a href="attachment.cgi?id=21215&action=edit" title="Example file that demonstrates Clang SA false-positive.">[details]</a></span>
Example file that demonstrates Clang SA false-positive.
I have the following situation where I am copying from var1 -> var2 (both of
which are structures aligned to word boundaries) by typecasting them to integer
pointers first and copying them as integers (this is for an embedded system
where only word-aligned reads/writes are possible).
I have example code attached with this bug report (analyzed with Clang 4.0.1).
If do any of the following:
1. var2 = var1.
2. memcpy(&var2, &var1, sizeof(var_t));
3. copy var1 to var2 field-by-field.
Clang SA considers all fields in var2 to be initialized.
If I copy var1 to var2 by typecasting them to word (uint32) pointers and
copying them as uint32, Clang SA doesn't realize that all the fields in var2
has been written. For example:
// Method #1: copy var1 -> var2 as a word (sizeof(unsigned int) = 4).
unsigned int *src = (unsigned int *) &var1;
unsigned int *dest = (unsigned int *) &var2;
*dest = *src;
This generates false-positives on subsequent access to fields on var2, where
Clang SA complains that some fields in var2 are used uninitialized.
Please see the output below for the attached code:
$ clang --version
clang version 4.0.0 (tags/RELEASE_401/final)
Target: x86_64-unknown-linux-gnu
Thread model: posix
$ clang -Wall clang_sa.c
$ ./a.out
1, 2, 3
1, 2, 3
sizeof(unsigned int) = 4
$ scan-build clang clang_sa.c
scan-build: Using '<snipped>/clang-4.0' for static analysis
clang_sa.c:33:3: warning: Function call argument is an uninitialized value
printf("%d, %d, %d\n", var2.f0, var2.f1, var2.f2); // <--- Function call
argument is an uninitialized value
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
scan-build: 1 bug found.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>