Skip to content

clang-analyzer-core.StackAddressEscape false-positive #106834

Closed
@zufuliu

Description

@zufuliu

https://godbolt.org/z/Yqr53rz4s

extern void copy(char *output, const char *input, unsigned size);
extern bool foo(const char *input);
extern void bar(char *output, unsigned count);
extern bool baz(char *output, const char *input);

void repo(const char *input, char *output) {
    char temp[64];
    copy(temp, input, sizeof(temp));

    char result[64];
    input = temp;
    if (foo(temp)) {
        bar(result, sizeof(result));
        input = result;
    }
    if (!baz(output, input)) {
        copy(output, input, sizeof(result));
    }
}
<source>:16:5: warning: Address of stack memory associated with local variable 'temp' is still referred to by the caller variable 'input' upon returning to the caller.  This will be a dangling reference [clang-analyzer-core.StackAddressEscape]
    7 |     char temp[64];
      |     ~~~~~~~~~~~~~
    8 |     copy(temp, input, sizeof(temp));
    9 | 
   10 |     char result[64];
   11 |     input = temp;
   12 |     if (foo(temp)) {
   13 |         bar(result, sizeof(result));
   14 |         input = result;
   15 |     }
   16 |     if (!baz(output, input)) {
      |     ^
[<source>:12:9: note: Assuming the condition is false](javascript:;)
   12 |     if (foo(temp)) {
      |         ^~~~~~~~~
[<source>:12:5: note: Taking false branch](javascript:;)
   12 |     if (foo(temp)) {
      |     ^
[<source>:16:9: note: Assuming the condition is false](javascript:;)
   16 |     if (!baz(output, input)) {
      |         ^~~~~~~~~~~~~~~~~~~
[<source>:16:5: note: Taking false branch](javascript:;)
   16 |     if (!baz(output, input)) {
      |     ^
<source>:16:5: note: Address of stack memory associated with local variable 'temp' is still referred to by the caller variable 'input' upon returning to the caller.  This will be a dangling reference
    7 |     char temp[64];
      |     ~~~~~~~~~~~~~
    8 |     copy(temp, input, sizeof(temp));
    9 | 
   10 |     char result[64];
   11 |     input = temp;
   12 |     if (foo(temp)) {
   13 |         bar(result, sizeof(result));
   14 |         input = result;
   15 |     }
   16 |     if (!baz(output, input)) {
      |     ^
1 warning generated.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions