From ac3966e315ada63eb379d560a012fa77c3909155 Mon Sep 17 00:00:00 2001
From: David Malcolm <dmalcolm@redhat.com>
Date: Tue, 5 Jan 2021 20:54:50 -0500
Subject: [PATCH] analyzer: fix false leaks when writing through unknown ptrs
 [PR97072]

gcc/analyzer/ChangeLog:
	PR analyzer/97072
	* region-model-reachability.cc (reachable_regions::init_cluster):
	Convert symbolic region handling to a switch statement.  Add cases
	to handle SK_UNKNOWN and SK_CONJURED.

gcc/testsuite/ChangeLog:
	PR analyzer/97072
	* gcc.dg/analyzer/pr97072.c: New test.
---
 gcc/analyzer/region-model-reachability.cc | 36 +++++++++++++++++++++++--------
 gcc/testsuite/gcc.dg/analyzer/pr97072.c   |  9 ++++++++
 2 files changed, 36 insertions(+), 9 deletions(-)
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/pr97072.c

diff --git a/gcc/analyzer/region-model-reachability.cc b/gcc/analyzer/region-model-reachability.cc
index daf7852..a988ffc 100644
--- a/gcc/analyzer/region-model-reachability.cc
+++ b/gcc/analyzer/region-model-reachability.cc
@@ -88,20 +88,38 @@ reachable_regions::init_cluster (const region *base_reg)
   if (m_store->escaped_p (base_reg))
     add (base_reg, true);
 
-  /* If BASE_REG is *INIT_VAL(REG) for some other REG, see if REG is
-     unbound and untouched.  If so, then add BASE_REG as a root.  */
   if (const symbolic_region *sym_reg = base_reg->dyn_cast_symbolic_region ())
     {
       const svalue *ptr = sym_reg->get_pointer ();
-      if (const initial_svalue *init_sval = ptr->dyn_cast_initial_svalue ())
+      switch (ptr->get_kind ())
 	{
-	  const region *init_sval_reg = init_sval->get_region ();
-	  const region *other_base_reg = init_sval_reg->get_base_region ();
-	  const binding_cluster *other_cluster
-	    = m_store->get_cluster (other_base_reg);
-	  if (other_cluster == NULL
-	      || !other_cluster->touched_p ())
+	default:
+	  break;
+	case SK_INITIAL:
+	  {
+	    /* If BASE_REG is *INIT_VAL(REG) for some other REG, see if REG is
+	       unbound and untouched.  If so, then add BASE_REG as a root.  */
+	    const initial_svalue *init_sval
+	      = as_a <const initial_svalue *> (ptr);
+	    const region *init_sval_reg = init_sval->get_region ();
+	    const region *other_base_reg = init_sval_reg->get_base_region ();
+	    const binding_cluster *other_cluster
+	      = m_store->get_cluster (other_base_reg);
+	    if (other_cluster == NULL
+		|| !other_cluster->touched_p ())
+	      add (base_reg, true);
+	  }
+	  break;
+
+	case SK_UNKNOWN:
+	case SK_CONJURED:
+	  {
+	    /* If this cluster is due to dereferencing an unknown/conjured
+	       pointer, any values written through the pointer could still
+	       be live.  */
 	    add (base_reg, true);
+	  }
+	  break;
 	}
     }
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr97072.c b/gcc/testsuite/gcc.dg/analyzer/pr97072.c
new file mode 100644
index 0000000..4024124
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/pr97072.c
@@ -0,0 +1,9 @@
+void unknown_fn_1 (void *);
+
+void test_1 (int co, int y)
+{
+  void *p = __builtin_malloc (1024);
+  void **q;
+  unknown_fn_1 (&q);
+  *q = p;
+}
-- 
2.7.4