llvm / llvm/llvm-project

core.StackAddressEscape checker produce invalid detection

Open
#165,762 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

clang:static analyzer false-positive
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

The core.StackAddressEscape produce invalid disgnostics (false positive) in the following case:
```
#include

class LocalClass;
class VEI {
public:
VEI():pLocal(nullptr) {}
LocalClass *pLocal;
};

class LocalClass {
public:
LocalClass(VEI *v):p(v) {}
VEI *p;
~LocalClass() { p->pLocal = nullptr; }
void updateVei() {
if(p->pLocal != this) {
p->pLocal = this;
}
}
};

intptr_t funct(VEI *vei) {
LocalClass ohRly(vei);
ohRly.updateVei();
return (intptr_t)vei;
}

int main(void) {
VEI vei;
intptr_t res = funct(&vei);
return res > 0x7FFF;
}
```
The problem is the program context is analyzed at the time of return (line 32) but actual removal of local variable reference happens in the destructor and then context is actually destroyed.
The godbolt reference demonstrating the same is available though this [link](https://godbolt.org/#z:OYLghAFBqd5QCxAYwPYBMCmBRdBLAF1QCcAaPECAMzwBtMA7AQwFtMQByARg9KtQYEAysib0QXACx8BBAKoBnTAAUAHpwAMvAFYTStJg1DIApACYAQuYukl9ZATwDKjdAGFUtAK4sGIAJykrgAyeAyYAHI%2BAEaYxCAAzGakAA6oCoRODB7evgGp6ZkCoeFRLLHxSbaY9o4CQgRMxAQ5Pn6BdpgOWQ1NBCWRMXGJyQqNza15HeP9YYPlw0kAlLaoXsTI7BwA9NsAtAeHR8cnp2fnF5dX1ze3dwcmGgCCuwDUT%2BjoxJgKCq%2BoVFeYyYyAA1q82CwSABPV5MX6oZB4JgETDoV4Ad0ICFetERYleADcmsjovRXmAOKgEAAlWjQymvb4EdbhdFEV6iWj0YivEwAVgsaG%2BADpemCPl8fgpsApRClMAKACKPF7bV4AFQQeD%2BWO5r1icNe6EMwFoYWATMwVDijE2fMFwswYsaEs%2B31%2Bsvliv5Kueu1VbwOhjE0IAXphXnsABoh%2BkR3l7OPhuJ7ZAILqguImBJKp2B/b3IvFkulssl1WVswJMLIbxYPkJNxjfCCEUIHPYSvPOvwv7BfG0NwGX45qw9kd/ABq2AAknyAOzjp4pLxkvDIECq16vGeziBLEApAdciAMLzclIEYhLRdWBdKnfb14nsTDvuvABUx8HY8rD7/Z5VV7X4X0Hd9QJMJdVVXddN2fHdXyHScID3L9CUPFIIAwu8oL9J4dx3NDv0AgjCIAPyQiCFAPO9XhSPZOx/LlG0fc9L2vMdF3wwiiVQPB0S8FITVRKdMDwWioOXXjeLwKgIAYpikIpMAc0fAhtQUW8pIQmSd0UhJsGYgk1NeDSdVIvSnwA55eLw/8VQSZdVTCAgr2IAB9AhXioLwGAcVC53Q8TtOg2ywK5aj/lpelsJCyzorpaERSEkTMDEiSlgS5lWVeCBXPcrylkJcTSPsoDnlciEmDCbD%2BPQULpMItCSrwBKdwK68vKtP5TN8/yCAgcwADZWqypzdJy4gGB6xtsFeDRVAXAAxVaypsp4OBWWhOH5Xg/A4LRSFQTg3GsawgTWDZI3MBIeFIAhNC2lZQRAflJBFfx%2BS4fxJAADg0MwpD%2B6t%2BX0ThJH2p7js4XgFBADQHqelY4FgJA1jcrwCHISg0BYFI6DiCJWC2VQ/uGvZhskTkDCMV4EhFamID7OI6gYLTeDRQgSAEvR%2BEEEQxHYKQZEERQVHUQ6dD0DFiCYFJOB4bbdqhqWYY4AB5LHV28gFXjJimqZp008uvPzQVvCAPHxwneVurgll4R6pZRpA8YJnkcYgd3bZQWngC84hzb4OhUWIeGIGiRXeGiMImmhaPSFj5hiGhDXom0LpnfuvG2EEDWGHpROsGiLxgDcMRaHh7heCwFhTXEGvSHwb5uhK6v7swVQuixrYjtcmpofNaI5dTjwsET688BYROSuIaJ0kwJVMHroxzSMZG%2BAMYAFCnPBMAxDWFQO%2B7%2BeELlhekM/xbUaHdC4fRTRQc7LH0PBonhyAVlQK8smr4NmDxkjDGZMCYoygNTOmTM2ZcxOijAAdQYKgPYfkvBKHQGmVALBV4YPXpgJMxBgA%2BEYAQXgqA57EAEj8eAKxOjdGcBAVwkw/APxCHMMoFQ9BpAyGzZhXDChswGBw4YD86Fs16BMTwbQ9BiJ6DMIRQx4iiJmHw5RfQFELCUbQq6mwJDKw4HtUgB0jonQ4PrcmlNqa9jphAM2DALZ5VwNzO21YHZO2RisDMTAsDxAPKQV6kh%2BQig0P9DQ31/ALj%2Bt9BcVNwYcEhqQGeXANCI2MWQ2GtgEZIxdvoswqsTEZOdloJYKw54ZGcJIIAA).

**Observed behavior**:
The error `32:3: warning: Address of stack memory associated with local variable 'ohRly' returned to caller [core.StackAddressEscape]` is reported.

**Expected behavior**:
No diagnostics reported as no actual stack escape happens here as `vei.pLocal` is actually equals to `nullptr` in line 38 if the provided example.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the provided C++ example with the core.StackAddressEscape checker and inspect why the diagnostic is produced at the return statement. Compare the reported warning with the destructor's clearing of vei.pLocal; done means the example no longer produces the false-positive diagnostic.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.