TrustInSoft / tis-interpreter

An interpreter for finding subtle bugs in programs written in standard C
565 stars 28 forks source link

No warnings: offsetof and flexible array member -- overflows and negative indices #121

Open ch3root opened 8 years ago

ch3root commented 8 years ago

Source code:

#include <stdint.h>
#include <stddef.h>
#include <stdio.h>

int main()
{
  printf("%zu\n", offsetof(struct { char i; char a[]; }, a[-1]));
  printf("%zu\n", offsetof(struct { char i; char a[]; }, a[SIZE_MAX]));
}

tis-interpreter (21f4c7a763b4601d723ea5749185c97115c9c98a) output:

[value] Analyzing a complete application starting at main
[value] Computing initial state
[value] Initial state computed

0

0

[value] done for function main

gcc (GCC) 7.0.0 20160704 (experimental):

$ gcc -std=c11 -pedantic -Wall -Wextra -O3 -fsanitize=undefined test.c && ./a.out
0
0

clang version 3.9.0 (trunk 274502):

$ clang -std=c11 -Weverything -O3 -fsanitize=undefined test.c && ./a.out
test.c:7:19: warning: using extended field designator is an extension [-Wextended-offsetof]
  printf("%zu\n", offsetof(struct { char i; char a[]; }, a[-1]));
                  ^                                       ~~~~
.../lib/clang/3.9.0/include/stddef.h:120:24: note: expanded from macro 'offsetof'
#define offsetof(t, d) __builtin_offsetof(t, d)
                       ^                     ~
test.c:8:19: warning: using extended field designator is an extension [-Wextended-offsetof]
  printf("%zu\n", offsetof(struct { char i; char a[]; }, a[SIZE_MAX]));
                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.../lib/clang/3.9.0/include/stddef.h:120:24: note: expanded from macro 'offsetof'
#define offsetof(t, d) __builtin_offsetof(t, d)
                       ^                     ~
2 warnings generated.
0
0