[llvm-bugs] [Bug 41833] New: CSA assumes illegal array access

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=41833

            Bug ID: 41833
           Summary: CSA assumes illegal array access
           Product: clang
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: Static Analyzer
          Assignee: dcoughlin at apple.com
          Reporter: jhenry at grammatech.com
                CC: dcoughlin at apple.com, llvm-bugs at lists.llvm.org

I was expecting CSA to find an array-out-of-bounds error when dereferencing
s[1] in the following code:

-----------------
extern char *fcall();

static void example(buf, size, endp) char *buf;
int size;
char **endp;
{
    register char *beg;
    beg = buf+1;
    // begin
    beg = fcall();
    if (beg != buf + 4) {
        return;
    }
    // end
    if (beg > buf && beg[-1] != '\n') {
      char *s = "";
      char c = s[1];
    }
}
-----------------

In the above code, if we comment the lines between // begin and // end, the bug
is found because beg[-1] is safe. 
However, if we have a call to an external function that changes the value of
beg, clang somehow assumes that beg[-1] is always incorrect (and consequently
stops the exploration of that path).
I've added an earlier check that makes sure beg == buf+4 but that did not help.

Is this the expected behavior?

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20190510/ac6eeddd/attachment.html>