1  /* PR tree-optimization/101397 - spurious warning writing to the result
       2     of stpcpy minus 1
       3     { dg-do compile }
       4     { dg-options "-O2 -Wall" } */
       5  
       6  char* stpcpy (char*, const char*);
       7  
       8  void sink (int, ...);
       9  
      10  extern char ax[], a3[3], a5[5], *s;
      11  
      12  volatile int x;
      13  
      14  void test_stpcpy (int i)
      15  {
      16    {
      17      char *p = stpcpy (ax, s);
      18      x = p[-9];                          // { dg-bogus "\\\[-Warray-bounds" }
      19      x = p[-1];                          // { dg-bogus "\\\[-Warray-bounds" }
      20      x = p[ 0];
      21      x = p[+9];
      22    }
      23  
      24    {
      25      char *p = stpcpy (a3, s);
      26      x = p[-2];                          // { dg-bogus "\\\[-Warray-bounds" }
      27      x = p[-1];                          // { dg-bogus "\\\[-Warray-bounds" }
      28    }
      29  
      30    {
      31      char *p = stpcpy (a3, s);
      32      x = p[-3];                          // { dg-warning "\\\[-Warray-bounds" }
      33      sink (p[-2], p[-1], p[0], p[1], p[2]);
      34      x = p[ 3];                          // { dg-warning "\\\[-Warray-bounds" }
      35    }
      36  
      37    {
      38      /* Stpcpy always returns a pointer to the copied nul (which must
      39         exist) and never a past-the-end pointer.  As a result, P below
      40         is in [a5, a5 + 4].  */
      41      char *p = stpcpy (a5, s);
      42      x = p[-5];                          // { dg-warning "\\\[-Warray-bounds" }
      43      sink (p[-4], p[-3], p[-2], p[-1], p[0]);
      44      sink (p[1], p[2], p[3], p[4]);
      45      x = p[ 5];                          // { dg-warning "\\\[-Warray-bounds" }
      46    }
      47  
      48    {
      49      char *p = stpcpy (a5 + 1, s);
      50      x = p[-5];                          // { dg-warning "\\\[-Warray-bounds" }
      51      sink (p[-4], p[-3], p[-2], p[-1], p[0]);
      52      sink (p[1], p[2], p[3]);
      53      x = p[ 4];                          // { dg-warning "\\\[-Warray-bounds" }
      54    }
      55  
      56    {
      57      char *p = stpcpy (a5 + 2, s);
      58      x = p[-5];                          // { dg-warning "\\\[-Warray-bounds" }
      59      sink (p[-4], p[-3], p[-2], p[-1], p[0]);
      60      sink (p[1], p[2]);
      61      x = p[ 3];                          // { dg-warning "\\\[-Warray-bounds" }
      62    }
      63  
      64    {
      65      char *p = stpcpy (a5 + 3, s);
      66      x = p[-5];                          // { dg-warning "\\\[-Warray-bounds" }
      67      sink (p[-4], p[-3], p[-2], p[-1], p[0]);
      68      sink (p[1]);
      69      x = p[ 2];                          // { dg-warning "\\\[-Warray-bounds" }
      70    }
      71  
      72    {
      73      /* Because strlen (a3) is at most 2, the stpcpy call must return
      74         a pointer in the range [ax, ax + 2], and so -3 is necessarily
      75         out of bounds.  */
      76      char *p = stpcpy (ax, a3);
      77      p[-3] = 1;                          // { dg-warning "\\\[-Warray-bounds" }
      78    }
      79  
      80    {
      81      if (i >= 0)
      82        i = -1;
      83  
      84      char *p = stpcpy (a3, s);
      85      x = p[i];                           // { dg-bogus "\\\[-Warray-bounds" }
      86    }
      87  
      88    {
      89      if (i >= -3)
      90        i = -3;
      91  
      92      char *p = stpcpy (a3, s);
      93      p[i] = 1;                           // { dg-warning "\\\[-Warray-bounds" }
      94    }
      95  
      96  }