<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - clang-analyzer report undefined or garbage value with bit operations"
href="https://bugs.llvm.org/show_bug.cgi?id=47695">47695</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>clang-analyzer report undefined or garbage value with bit operations
</td>
</tr>
<tr>
<th>Product</th>
<td>clang
</td>
</tr>
<tr>
<th>Version</th>
<td>10.0
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Static Analyzer
</td>
</tr>
<tr>
<th>Assignee</th>
<td>dcoughlin@apple.com
</td>
</tr>
<tr>
<th>Reporter</th>
<td>b.buschinski@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>dcoughlin@apple.com, llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>For the code
```
struct x {
unsigned char * buf;
unsigned int len;
};
unsigned short foo(unsigned char const * const buf, unsigned char const size,
unsigned short const cr, unsigned char * const out)
{
unsigned char i;
for (i = 0; i < size; i++) {
out[i] = buf[i] ^ cr; // bad
// out[i] = (unsigned int)buf[i] ^ (unsigned int)cr; // good
// out[i] = (unsigned char)((unsigned short)buf[i] ^ (unsigned
short)cr); // bad
// out[i] = buf[i] | cr; // bad
// out[i] = buf[i] & cr; // bad
// out[i] = buf[i] + cr; // good
// out[i] = buf[i] - cr; // good
}
return 3;
}
unsigned int doit(struct x * x)
{
unsigned short k;
unsigned int ret_len = 0;
unsigned char skip, pbuf[18];
k = foo(x->buf, 3, 1, pbuf);
skip = pbuf[2];
if (skip < 5) {
foo(x->buf + 3, skip + 2, k, pbuf);
ret_len = pbuf[skip];
ret_len |= (pbuf[skip + 1] << 8);
}
return ret_len;
}
```
clang reports:
```
$ scan-build gcc -c clang-10-staticanalyzer-bitmagic.c
scan-build: Using '/usr/lib/llvm/10/bin/clang-10' for static analysis
clang-10-staticanalyzer-bitmagic.c:36:17: warning: Assigned value is garbage or
undefined
ret_len = pbuf[skip];
^ ~~~~~~~~~~
1 warning generated.
scan-build: 1 bug found.
...
$ clang --version
clang version 10.0.1
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/lib/llvm/10/bin
```
but only for the marked "// bad" lines, the bit operations ^ & | are causing
problems while + - are fine.
Maybe I don't understand be bug, but it seems like false positive to me.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>