Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 898152 - 90gcc-warnings: improve fortify_source warnings
Summary: 90gcc-warnings: improve fortify_source warnings
Status: CONFIRMED
Alias: None
Product: Portage Development
Classification: Unclassified
Component: Core (show other bugs)
Hardware: All Linux
: Normal enhancement
Assignee: Portage team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-02-27 13:13 UTC by Agostino Sarubbo
Modified: 2024-08-25 16:37 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2023-02-27 13:13:37 UTC
https://github.com/gentoo/portage/blob/0fdbbbdb5a80e331adf701f2b2c1f096695447c4/bin/install-qa-check.d/90gcc-warnings#L39

I did a search into bugzilla attachment data and it looks like that:
"assuming pointer wraparound does not occur" is [-Wstrict-overflow]

The more recent examples are:
895802
527476
Comment 1 Agostino Sarubbo gentoo-dev 2023-02-27 13:20:17 UTC
regarding "will always overflow destination buffer" i didn't found a recent build log that reports this, and looks to be very odd.
Is there a chance that compiler output changed about this topic?

I'd like to consider a test where we compile (at least with gcc) a piece of code affected by this warning and then check if the output contains "will always overflow destination buffer" otherwise there is a risk that we look for something that does not exist anymore.


In any case, while looking at app-emulation/hercules for "will always overflow destination buffer" warning ( bug 521032 ) I found something a bit similar like -Wformat-overflow and -Wformat-truncation.
Is this something we want in 90gcc-warnings?
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-02-27 17:10:41 UTC
So, in comment 0, you're saying that "assuming pointer wraparound does not occur" should be changed to have "[-Wstrict-overflow]" at the end, yeah, because it has a name now (GCC didn't always give the names at the end of warnings)?

In comment 1, yeah, that's definitely very possible. We try to keep a range of phrases until the compilers are definitley obsolete because these things are so unreliable. Your test would make sense though to catch when a compiler *stops* matching anything in the list (we wouldn't necc. remove old entries, but add new ones).

So, your suggestions are:
- Change one of the tests to have -Wstrict-overflow at the end
- Maybe add a test to make sure some specific cases match something

Any others?
Comment 3 Agostino Sarubbo gentoo-dev 2023-03-01 11:41:59 UTC
(In reply to Sam James from comment #2)
> So, in comment 0, you're saying that "assuming pointer wraparound does not
> occur" should be changed to have "[-Wstrict-overflow]" at the end, yeah,
> because it has a name now

right

> (GCC didn't always give the names at the end of warnings)?

Unfortunately no

> So, your suggestions are:
> - Change one of the tests to have -Wstrict-overflow at the end
> - Maybe add a test to make sure some specific cases match something
> 
> Any others?

Evaluate if "-Wformat-overflow" and "-Wformat-truncation" are suitable for our checks.
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-03-02 07:46:02 UTC
Got it, thanks!
Comment 5 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2024-08-25 16:12:39 UTC
Those are both noisy middle-end warnings so I'd say let's avoid it.

commit 9a06b7210562b8d03577cd4043227ea2023db1f2
Author: Sam James <sam@gentoo.org>
Date:   Sun Feb 25 08:13:28 2024 +0000

    bin/install-qa-check.d: 90gcc-warnings: drop GCC warnings with known (heavy) FPs

    Drop -Wstringop-overflow, -Wstringop-overread, -Wstringop-truncation, -Waddress,
    and -Wreturn-local-addr for now because they cause too many FPs.

    We want only reliable warnings for this Portage QA check as we encourage people
    to report these upstream.

    Bug: https://gcc.gnu.org/PR88443
    Bug: https://gcc.gnu.org/PR88781
    Bug: https://gcc.gnu.org/PR93644
    Bug: https://gcc.gnu.org/PR97048
    Bug: https://gcc.gnu.org/PR103360
    Bug: https://bugs.gentoo.org/925460
    Signed-off-by: Sam James <sam@gentoo.org>
Comment 6 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2024-08-25 16:13:43 UTC
-Wformat-truncation is already there. -Wformat-overflow isn't, but I may add it commented out (see above).

I'll look at adding -Wstrict-overflow too (but it's unrelated to _F_S, I think).
Comment 7 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2024-08-25 16:20:50 UTC Comment hidden (obsolete)