https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110501
John Baldwin <jhb at FreeBSD dot org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jhb at FreeBSD dot org
--- Comment #7 from John Baldwin <jhb at FreeBSD dot org> ---
I believe I am hitting this same issue using GCC 13 to compile FreeBSD's
userland. (I looked through several of the other bugs for the Wuse-after-free
metabug and this one seems the closest to what I'm encountering). The code in
question does not trigger the -Wuse-after-free warning when using GCC 12, but
now triggers the warning with GCC 13. It is just calling free on the old value
after realloc fails which should be safe. The simplest version I've
encountered so far in FreeBSD's tree is this:
static int
group_resize(void)
{
char *buf;
if (gbufsize == 0)
gbufsize = 1024;
else
gbufsize *= 2;
buf = gbuffer;
gbuffer = realloc(buf, gbufsize);
if (gbuffer == NULL) {
free(buf);
gbufsize = 0;
return (ENOMEM);
}
memset(gbuffer, 0, gbufsize);
return (0);
}
The warning triggers on the call to free:
lib/libcasper/services/cap_grp/cap_grp.c: In function 'group_resize':
lib/libcasper/services/cap_grp/cap_grp.c:65:17: error: pointer 'buf' may be
used after 'realloc' [-Werror=use-after-free]
65 | free(buf);
| ^~~~~~~~~
lib/libcasper/services/cap_grp/cap_grp.c:63:19: note: call to 'realloc'
here
63 | gbuffer = realloc(buf, gbufsize);
| ^~~~~~~~~~~~~~~~~~~~~~
