[llvm-bugs] [Bug 47695] New: clang-analyzer report undefined or garbage value with bit operations

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=47695

            Bug ID: 47695
           Summary: clang-analyzer report undefined or garbage value with
                    bit operations
           Product: clang
           Version: 10.0
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: Static Analyzer
          Assignee: dcoughlin at apple.com
          Reporter: b.buschinski at gmail.com
                CC: dcoughlin at apple.com, llvm-bugs at lists.llvm.org

For the code

```
struct x {
    unsigned char * buf;
    unsigned int len;
};

unsigned short foo(unsigned char const * const buf, unsigned char const size,
                   unsigned short const cr, unsigned char * const out)
{
    unsigned char i;

    for (i = 0; i < size; i++) {
        out[i] = buf[i] ^ cr; // bad
//         out[i] = (unsigned int)buf[i] ^ (unsigned int)cr; // good
//         out[i] = (unsigned char)((unsigned short)buf[i] ^ (unsigned
short)cr); // bad
//         out[i] = buf[i] | cr; // bad
//         out[i] = buf[i] & cr; // bad
//         out[i] = buf[i] + cr; // good
//         out[i] = buf[i] - cr; // good
    }

    return 3;
}

unsigned int doit(struct x * x)
{
    unsigned short k;
    unsigned int ret_len = 0;
    unsigned char skip, pbuf[18];

    k = foo(x->buf, 3, 1, pbuf);

    skip = pbuf[2];
    if (skip < 5) {
        foo(x->buf + 3, skip + 2, k, pbuf);

        ret_len = pbuf[skip];
        ret_len |= (pbuf[skip + 1] << 8);
    }
    return ret_len;
}
```

clang reports:
```
$ scan-build gcc -c clang-10-staticanalyzer-bitmagic.c                     
scan-build: Using '/usr/lib/llvm/10/bin/clang-10' for static analysis
clang-10-staticanalyzer-bitmagic.c:36:17: warning: Assigned value is garbage or
undefined
       ret_len = pbuf[skip];
               ^ ~~~~~~~~~~
1 warning generated.
scan-build: 1 bug found.
...

$ clang --version
clang version 10.0.1 
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/lib/llvm/10/bin
```

but only for the marked "// bad" lines, the bit operations ^ & | are causing
problems while + - are fine.
Maybe I don't understand be bug, but it seems like false positive to me.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20200930/be35a54c/attachment.html>