llvm / llvm/llvm-project

sized_by(_or_null) should not be allowed when size expression cannot represent a single element

Open
#223,525 0 comments 0 reactions 1 assignee Claimed by @delcypher View on GitHub
clang:bounds-safety
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Consider this code:

```
struct big { char data[256]; }; // 256-byte element

struct container {
unsigned char size; // 8-bit byte count, max 255
struct big *buf __attribute__((sized_by(size)));
};

char test(struct container *c, int i) {
return c->buf[i].data[0];
```

`sized_by(size)` as written can only allow a byte count of at most 255 bytes. However, `struct big` is 256 bytes. So this means the attribute cannot describe the pointer even pointing to a single element. We should disallow this in Sema.

I discovered this issue while working on #213795. After that lands the indexing operation in the `test` function into `buf` is a guaranteed trap. However, given we can see this problem at compile time we should make it a compile time error which will let us simplify codegen.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.