This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: [PATCH] Fix 'array subscript is above array bounds' warning in res_send.c
- From: OndÅej BÃlka <neleai at seznam dot cz>
- To: Adhemerval Zanella <azanella at linux dot vnet dot ibm dot com>
- Cc: libc-alpha at sourceware dot org
- Date: Tue, 16 Dec 2014 23:08:43 +0100
- Subject: Re: [PATCH] Fix 'array subscript is above array bounds' warning in res_send.c
- Authentication-results: sourceware.org; auth=none
- References: <20141216100950 dot GM30928 at spoyarek dot pnq dot redhat dot com> <mvm388fkifz dot fsf at hawking dot suse dot de> <20141216104514 dot GN30928 at spoyarek dot pnq dot redhat dot com> <mvmy4q7j20b dot fsf at hawking dot suse dot de> <20141216112624 dot GO30928 at spoyarek dot pnq dot redhat dot com> <5490254E dot 8060508 at linux dot vnet dot ibm dot com> <20141216125211 dot GW30928 at spoyarek dot pnq dot redhat dot com> <54902C9E dot 5030408 at linux dot vnet dot ibm dot com> <20141216130524 dot GX30928 at spoyarek dot pnq dot redhat dot com> <54902FB8 dot 8070006 at linux dot vnet dot ibm dot com>
On Tue, Dec 16, 2014 at 11:12:24AM -0200, Adhemerval Zanella wrote:
> On 16-12-2014 11:05, Siddhesh Poyarekar wrote:
> > On Tue, Dec 16, 2014 at 10:59:10AM -0200, Adhemerval Zanella wrote:
> >> My understanding is to not shadow possible compiler issues with unrequired
> >> code.
> > I don't think this is a compiler issue since I don't think the
> > compiler will ever be able to evaluate that the range for the nscounts
> > will be limited to MAXNS. In fact, given the wide usage of nscount
> > within the code, a bug could technically send the nscounts beyond
> > MAXNS.
> >
> > Siddhesh
>
> 426 if (statp->nscount > EXT(statp).nscount)
> 427 for (n = EXT(statp).nscount, ns = 0;
> 428 n < statp->nscount; n++) {
> 429 while (ns < MAXNS
> 430 && EXT(statp).nsmap[ns] != MAXNS)
> 431 ns++;
> 432 if (ns >= MAXNS)
> 433 break;
> 434 EXT(statp).nsmap[ns] = n;
> 435 map[n] = ns++;
> 436 }
>
> In this loop 'ns' is initialized to '0' and updated on a simple while with
> 2 constraints. Someone with more compiler background could correct me, but
> I don't think this is really hard to compile evaluate that will fall
> in 0 <= ns < MAXNS in all cases.
Something is fishy here as compile should detect that in range
propagation pass.
If you are not sure you could always check if it optimizes simpler code.
And my gcc-4.9.1-2 indeed simplifies this to zero, Siddhesh could you
check it too?
int foo (int x)
{
int i;
for (i=0; i < 1000000; i++)
{
if (i > 1000000)
return 1;
}
return 0;
}