Geoffrey1014/SA_Bugs

GCC Static Analyzer does not kown `c || b.d` is false with the fact that `c=0` and `b.d=0`

Opened this issue · 2 comments

0-0x41 commented

date: 2023-1-28
commit: 8c8ca873216387bc26046615c806b96f0345ff9d
args: -O0 -fanalyzer
test:

void __analyzer_eval();


struct a
{
    int d : 10;
}

e(){
    struct a b;
    int c;

    c = 0;
    b.d = 0;
    int *p = (int *)0;
    if (c || b.d)
    {
        __analyzer_eval(c || b.d);
        __analyzer_eval(c);
        __analyzer_eval(b.d);
        *p = 42;
    }
}

report: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109197
fix:
original:

0-0x41 commented

GSA does not kown c || b.d is false with the fact that c=0 and b.d=0, but CSA kowns.

See it live:
GSA: https://godbolt.org/z/vd3Tvdods
CSA: https://godbolt.org/z/PEnv6Ece4

Input:

void __analyzer_eval();


struct a
{
    int d : 10;
}

e(){
    struct a b;
    int c;

    c = 0;
    b.d = 0;
    int *p = (int *)0;
    if (c || b.d)
    {
        __analyzer_eval(c || b.d);
        __analyzer_eval(c);
        __analyzer_eval(b.d);
        *p = 42;
    }
}