llvm / llvm/llvm-project

[analyzer] Fails to load from a bitfield that was covered by a type-punned write before

Open
#188,357 10 comments 0 reactions 0 assignees View on GitHub
clang:static analyzer false-positive
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

The [commit](https://github.com/llvm/llvm-project/commit/a6a34333a113) causing false positives:
Minimal reproducer:

```c++
// Minimal reproducer for core.uninitialized.Assign false positive
// introduced by LLVM commit a6a34333a113 (present in main).
//
// main: reports "Assigned value is uninitialized" on *out = s.val
// Reverted: no finding (correct)
//
// Reproduce:
// clang --analyze -Xanalyzer -analyzer-checker=core single.c

typedef struct {
unsigned pad : 4;
unsigned val : 4;
} S1;

unsigned* extern_func(unsigned*);

int callee_func(unsigned* out)
{
unsigned v;
unsigned* p = extern_func(&v);

if (p != &v)
return 1;

*out = *p;
return 0;
}

void caller_func(unsigned char* out)
{
S1 s = {0};

if (callee_func((unsigned*)&s) == 0)
*out = s.val;
}
```

Contributor guide

Open the contributing guide

Research direction

Start with the minimal reproducer in the issue and run the shown clang --analyze command with the core checker. Compare behavior against commit a6a34333a113; done means the analyzer no longer reports a false positive for the type-punned bitfield write while preserving the intended uninitialized-value diagnostic behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.