From 6ccadc4c0486ff011a32c74de1a31148acb3cbe2 Mon Sep 17 00:00:00 2001
From: Martin Sebor <msebor@redhat.com>
Date: Sun, 30 Aug 2020 15:10:44 -0600
Subject: [PATCH] Use get_size_range instead of get_range to obtain range of
 valid sizes.

gcc/ChangeLog:

	* builtins.c (access_ref::access_ref): Call get_size_range instead
	of get_range.

gcc/testsuite/ChangeLog:

	* gcc.dg/Wstringop-overread-3.c: New test.
---
 gcc/builtins.c                              |   9 +-
 gcc/testsuite/gcc.dg/Wstringop-overread-3.c | 188 ++++++++++++++++++++
 2 files changed, 195 insertions(+), 2 deletions(-)
 create mode 100644 gcc/testsuite/gcc.dg/Wstringop-overread-3.c

diff --git a/gcc/builtins.c b/gcc/builtins.c
index df121f98b95..bc35b071f02 100644
--- a/gcc/builtins.c
+++ b/gcc/builtins.c
@@ -214,8 +214,13 @@ access_ref::access_ref (tree bound /* = NULL_TREE */,
   /* When BOUND is nonnull and a range can be extracted from it,
      set the bounds of the access to reflect both it and MINACCESS.
      BNDRNG[0] is the size of the minimum access.  */
-  if (bound && get_range (bound, UNSIGNED, bndrng))
-    bndrng[0] = bndrng[0] > 0 && minaccess ? 1 : 0;
+  tree rng[2];
+  if (bound && get_size_range (bound, rng, true))
+    {
+      bndrng[0] = wi::to_offset (rng[0]);
+      bndrng[1] = wi::to_offset (rng[1]);
+      bndrng[0] = bndrng[0] > 0 && minaccess ? 1 : 0;
+    }
 }
 
 /* Return true if NAME starts with __builtin_ or __sync_.  */
diff --git a/gcc/testsuite/gcc.dg/Wstringop-overread-3.c b/gcc/testsuite/gcc.dg/Wstringop-overread-3.c
new file mode 100644
index 00000000000..6c2c6b6a29d
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/Wstringop-overread-3.c
@@ -0,0 +1,188 @@
+/* Verify that calling strndup and strnlen with an unknown bound isn't
+   diagnosed regardless of the size of the array and the type of the bound.
+  { dg-do compile }
+  { dg-options "-O -Wall" } */
+
+#define NOIPA __attribute__ ((noipa))
+
+typedef __SIZE_TYPE__ size_t;
+
+extern char* strndup (const char*, size_t);
+extern size_t strnlen (const char*, size_t);
+
+/* TO DO: Passing a zero-length array to any function is almost certainly
+   a bug and should be diagnosed except perpaphs when the function also
+   takes a bound and its value is known to be zero.  When this is
+   implemented this test will need to be adjusted.  */
+extern char a0[0];
+
+extern char a1[1];
+
+NOIPA char* strndup_a0_si (short n)
+{
+  return strndup (a0, n);
+}
+
+NOIPA char* strndup_a0_i (int n)
+{
+  return strndup (a0, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA char* strndup_a0_li (long n)
+{
+  return strndup (a0, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA char* strndup_a0_lli (long long n)
+{
+  return strndup (a0, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+
+NOIPA char* strndup_a0_usi (unsigned short n)
+{
+  return strndup (a0, n);
+}
+
+NOIPA char* strndup_a0_ui (unsigned n)
+{
+  return strndup (a0, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA char* strndup_a0_uli (unsigned long n)
+{
+  return strndup (a0, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA char* strndup_a0_ulli (unsigned long long n)
+{
+  return strndup (a0, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+
+
+NOIPA char* strndup_a1_si (short n)
+{
+  return strndup (a1, n);
+}
+
+NOIPA char* strndup_a1_i (int n)
+{
+  return strndup (a1, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA char* strndup_a1_li (long n)
+{
+  return strndup (a1, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA char* strndup_a1_lli (long long n)
+{
+  return strndup (a1, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+
+NOIPA char* strndup_a1_usi (unsigned short n)
+{
+  return strndup (a1, n);
+}
+
+NOIPA char* strndup_a1_ui (unsigned n)
+{
+  return strndup (a1, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA char* strndup_a1_uli (unsigned long n)
+{
+  return strndup (a1, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA char* strndup_a1_ulli (unsigned long long n)
+{
+  return strndup (a1, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+
+NOIPA size_t strnlen_a0_si (short n)
+{
+  return strnlen (a0, n);
+}
+
+NOIPA size_t strnlen_a0_i (int n)
+{
+  return strnlen (a0, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA size_t strnlen_a0_li (long n)
+{
+  return strnlen (a0, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA size_t strnlen_a0_lli (long long n)
+{
+  return strnlen (a0, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+
+NOIPA size_t strnlen_a0_usi (unsigned short n)
+{
+  return strnlen (a0, n);
+}
+
+NOIPA size_t strnlen_a0_ui (unsigned n)
+{
+  return strnlen (a0, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA size_t strnlen_a0_uli (unsigned long n)
+{
+  return strnlen (a0, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA size_t strnlen_a0_ulli (unsigned long long n)
+{
+  return strnlen (a0, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+
+
+NOIPA size_t strnlen_a1_si (short n)
+{
+  return strnlen (a1, n);
+}
+
+NOIPA size_t strnlen_a1_i (int n)
+{
+  return strnlen (a1, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA size_t strnlen_a1_li (long n)
+{
+  return strnlen (a1, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA size_t strnlen_a1_lli (long long n)
+{
+  return strnlen (a1, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+
+NOIPA size_t strnlen_a1_usi (unsigned short n)
+{
+  return strnlen (a1, n);
+}
+
+NOIPA size_t strnlen_a1_ui (unsigned n)
+{
+  return strnlen (a1, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA size_t strnlen_a1_uli (unsigned long n)
+{
+  return strnlen (a1, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
+
+NOIPA size_t strnlen_a1_ulli (unsigned long long n)
+{
+  return strnlen (a1, n);     // { dg-bogus "\\\[-Wstringop-overread" }
+}
-- 
2.30.2