[all-commits] [llvm/llvm-project] c5eafb: [analyzer] Normalize sub-array indices in RegionSt...

[Endre Fülöp via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: c5eafbcc29c5d83deea9ae2232883ebef1febec0
      https://github.com/llvm/llvm-project/commit/c5eafbcc29c5d83deea9ae2232883ebef1febec0
  Author: Endre Fülöp <endre.fulop at sigmatechnology.com>
  Date:   2026-06-01 (Mon, 01 Jun 2026)

  Changed paths:
    M clang/lib/StaticAnalyzer/Core/RegionStore.cpp
    M clang/test/Analysis/bstring_UninitRead.c
    M clang/test/Analysis/initialization.c
    M clang/test/Analysis/initialization.cpp

  Log Message:
  -----------
  [analyzer] Normalize sub-array indices in RegionStore initializer res… (#200044)

…olution

After #198346, alpha.unix.cstring.UninitializedRead reports a false
positive when a pointer into a fully-initialized const multidimensional
array is advanced past an inner dimension boundary and used as a source
argument to memcpy. The root cause is in
`convertOffsetsFromSvalToUnsigneds` in RegionStore, which returned
UndefinedVal for any element index exceeding its sub-array extent,
conflating pointer arithmetic legality with memory initializedness.

This patch separates the two concerns. The RegionStore now normalizes
indices that overflow an inner dimension by carrying into the outer
dimension via divmod, the same way `arr[0][5]` in `int arr[4][3]`
denotes the same memory as `arr[1][2]`. UndefinedVal is returned only
when the computed flat offset exceeds the total array allocation.
Whether cross-subobject pointer arithmetic constitutes undefined
behavior per C/C++ standards is a separate concern for individual
checkers to diagnose. No existing checker flags sub-array boundary
crossing as UB, verified both before and after #198346.

Fixes #199271



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications