diff options
| -rw-r--r-- | include/clang/Sema/Sema.h | 2 | ||||
| -rw-r--r-- | lib/Sema/SemaChecking.cpp | 4 | ||||
| -rw-r--r-- | lib/Sema/SemaExpr.cpp | 6 | ||||
| -rw-r--r-- | test/Sema/array-bounds-ptr-arith.c | 7 |
4 files changed, 13 insertions, 6 deletions
diff --git a/include/clang/Sema/Sema.h b/include/clang/Sema/Sema.h index 0b08526d98..bd542da6a6 100644 --- a/include/clang/Sema/Sema.h +++ b/include/clang/Sema/Sema.h @@ -6200,7 +6200,7 @@ public: private: void CheckArrayAccess(const Expr *BaseExpr, const Expr *IndexExpr, const ArraySubscriptExpr *ASE=0, - bool AllowOnePastEnd=true); + bool AllowOnePastEnd=true, bool IndexNegated=false); void CheckArrayAccess(const Expr *E); bool CheckFunctionCall(FunctionDecl *FDecl, CallExpr *TheCall); bool CheckBlockCall(NamedDecl *NDecl, CallExpr *TheCall); diff --git a/lib/Sema/SemaChecking.cpp b/lib/Sema/SemaChecking.cpp index c8f2d05e0d..9bb532b532 100644 --- a/lib/Sema/SemaChecking.cpp +++ b/lib/Sema/SemaChecking.cpp @@ -4277,7 +4277,7 @@ static bool IsTailPaddedMemberArray(Sema &S, llvm::APInt Size, void Sema::CheckArrayAccess(const Expr *BaseExpr, const Expr *IndexExpr, const ArraySubscriptExpr *ASE, - bool AllowOnePastEnd) { + bool AllowOnePastEnd, bool IndexNegated) { IndexExpr = IndexExpr->IgnoreParenCasts(); if (IndexExpr->isValueDependent()) return; @@ -4292,6 +4292,8 @@ void Sema::CheckArrayAccess(const Expr *BaseExpr, const Expr *IndexExpr, llvm::APSInt index; if (!IndexExpr->EvaluateAsInt(index, Context)) return; + if (IndexNegated) + index = -index; const NamedDecl *ND = NULL; if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(BaseExpr)) diff --git a/lib/Sema/SemaExpr.cpp b/lib/Sema/SemaExpr.cpp index c18d37df5f..552d0e7f21 100644 --- a/lib/Sema/SemaExpr.cpp +++ b/lib/Sema/SemaExpr.cpp @@ -6203,11 +6203,9 @@ QualType Sema::CheckSubtractionOperands(ExprResult &LHS, ExprResult &RHS, if (!checkArithmeticOpPointerOperand(*this, Loc, LHS.get())) return QualType(); - Expr *IExpr = RHS.get()->IgnoreParenCasts(); - UnaryOperator negRex(IExpr, UO_Minus, IExpr->getType(), VK_RValue, - OK_Ordinary, IExpr->getExprLoc()); // Check array bounds for pointer arithemtic - CheckArrayAccess(LHS.get()->IgnoreParenCasts(), &negRex); + CheckArrayAccess(LHS.get(), RHS.get(), /*ArraySubscriptExpr*/0, + /*AllowOnePastEnd*/true, /*IndexNegated*/true); if (CompLHSTy) *CompLHSTy = LHS.get()->getType(); return LHS.get()->getType(); diff --git a/test/Sema/array-bounds-ptr-arith.c b/test/Sema/array-bounds-ptr-arith.c index c0e0d0ea78..022335bd37 100644 --- a/test/Sema/array-bounds-ptr-arith.c +++ b/test/Sema/array-bounds-ptr-arith.c @@ -12,3 +12,10 @@ void* broken (struct ext2_super_block *es,int a) { return (void *)es->s_uuid + 80; // expected-warning {{refers past the end of the array}} } + +// Test case reduced from PR11594 +struct S { int n; }; +void pr11594(struct S *s) { + int a[10]; + int *p = a - s->n; +} |