gcc -fanalyzer complains about double free, I don't understand why - c

Question

Edit: this is actually a known bug.
original question
I would love some help on this, because I just don't get it. Hopefully it's just something I don't understand.
I have a few functions to initialize and free memory of two types : a singular foo type and a plural foos_list type. Here is a full program reduced to the essential:
#define _GNU_SOURCE
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void *
xalloc (size_t len)
{
void *mem = malloc (len);
if (!mem)
{
fprintf (stderr, "can't allocated memory");
exit (1);
}
return mem;
}
void *
xrealloc (void *mem, size_t msize)
{
mem = realloc (mem, msize);
if (!mem)
{
fprintf (stderr, "can't allocate %zu bytes of memory\n", msize);
exit (1);
}
return mem;
}
typedef struct {
char *name;
} foo;
typedef struct {
foo **foos;
size_t foos_len;
} foos_list;
foo *
new_foo ()
{
foo *f = xalloc (sizeof (foo));
f->name = NULL;
return f;
}
void
free_foo (foo *f)
{
if (!f) return;
if (f->name) free (f->name);
free (f);
}
foos_list *
new_foos_list ()
{
foos_list *l = xalloc (sizeof (foos_list));
l->foos = NULL;
l->foos_len = 0;
return l;
}
void
free_foos_list (foos_list *l)
{
if (!l) return;
if (l->foos)
{
for (size_t i = 0; i < l->foos_len; i++)
free_foo (l->foos[i]);
free (l->foos);
}
free (l);
}
int main()
{
}
If I try to compile this, gcc throws an error of analyzer-use-after-free and one of analyzer-double-free.
$ gcc -Wall -Werror -fanalyzer -o test main.c
main.c: In function ‘free_foo’:
main.c:56:8: error: use after ‘free’ of ‘f’ [CWE-416] [-Werror=analyzer-use-after-free]
56 | if (f->name) free (f->name);
| ~^~~~~~
‘free_foos_list’: events 1-8
|
| 72 | free_foos_list (foos_list *l)
| | ^~~~~~~~~~~~~~
| | |
| | (1) entry to ‘free_foos_list’
| 73 | {
| 74 | if (!l) return;
| | ~
| | |
| | (2) following ‘false’ branch (when ‘l’ is non-NULL)...
| 75 |
| 76 | if (l->foos)
| | ~~~~~~~~
| | | |
| | | (3) ...to here
| | (4) following ‘true’ branch...
| 77 | {
| 78 | for (size_t i = 0; i < l->foos_len; i++)
| | ~~~ ~
| | | |
| | | (5) ...to here
| | (6) following ‘true’ branch...
| 79 | free_foo (l->foos[i]);
| | ~~~~~~~~~~~~~~~~~~~~~
| | | |
| | | (7) ...to here
| | (8) calling ‘free_foo’ from ‘free_foos_list’
|
+--> ‘free_foo’: events 9-10
|
| 53 | free_foo (foo *f)
| | ^~~~~~~~
| | |
| | (9) entry to ‘free_foo’
|......
| 58 | free (f);
| | ~~~~~~~~
| | |
| | (10) freed here
|
<------+
|
‘free_foos_list’: events 11-14
|
| 78 | for (size_t i = 0; i < l->foos_len; i++)
| | ~~~
| | |
| | (12) following ‘true’ branch...
| 79 | free_foo (l->foos[i]);
| | ^~~~~~~~~~~~~~~~~~~~~
| | | |
| | | (13) ...to here
| | (11) returning to ‘free_foos_list’ from ‘free_foo’
| | (14) calling ‘free_foo’ from ‘free_foos_list’
|
+--> ‘free_foo’: events 15-20
|
| 53 | free_foo (foo *f)
| | ^~~~~~~~
| | |
| | (15) entry to ‘free_foo’
| 54 | {
| 55 | if (!f) return;
| | ~
| | |
| | (16) following ‘false’ branch (when ‘f’ is non-NULL)...
| 56 | if (f->name) free (f->name);
| | ~~~~~~~~ ~~~~~~~
| | | | |
| | | | (19) ...to here
| | | (17) ...to here
| | (18) following ‘true’ branch...
| 57 |
| 58 | free (f);
| | ~~~~~~~~
| | |
| | (20) freed here
|
<------+
|
‘free_foos_list’: events 21-25
|
| 78 | for (size_t i = 0; i < l->foos_len; i++)
| | ~~~
| | |
| | (22) following ‘true’ branch...
| 79 | free_foo (l->foos[i]);
| | ^~~~~~~~~~~~~~~~~~~~~
| | | |
| | | (23) ...to here
| | | (24) freed here
| | (21) returning to ‘free_foos_list’ from ‘free_foo’
| | (25) calling ‘free_foo’ from ‘free_foos_list’
|
+--> ‘free_foo’: events 26-29
|
| 53 | free_foo (foo *f)
| | ^~~~~~~~
| | |
| | (26) entry to ‘free_foo’
| 54 | {
| 55 | if (!f) return;
| | ~
| | |
| | (27) following ‘false’ branch (when ‘f’ is non-NULL)...
| 56 | if (f->name) free (f->name);
| | ~~~~~~~
| | |
| | (28) ...to here
| | (29) use after ‘free’ of ‘f’; freed at (24)
|
main.c:56:16: error: double-‘free’ of ‘<unknown>’ [CWE-415] [-Werror=analyzer-double-free]
56 | if (f->name) free (f->name);
| ^~~~~~~~~~~~~~
‘free_foos_list’: events 1-10
|
| 72 | free_foos_list (foos_list *l)
| | ^~~~~~~~~~~~~~
| | |
| | (1) entry to ‘free_foos_list’
| 73 | {
| 74 | if (!l) return;
| | ~
| | |
| | (2) following ‘false’ branch (when ‘l’ is non-NULL)...
| 75 |
| 76 | if (l->foos)
| | ~~~~~~~~
| | | |
| | | (3) ...to here
| | (4) following ‘true’ branch...
| 77 | {
| 78 | for (size_t i = 0; i < l->foos_len; i++)
| | ~~~ ~
| | | |
| | | (5) ...to here
| | (6) following ‘true’ branch...
| | (8) following ‘true’ branch...
| 79 | free_foo (l->foos[i]);
| | ~~~~~~~~~~~~~~~~~~~~~
| | | |
| | | (7) ...to here
| | | (9) ...to here
| | (10) calling ‘free_foo’ from ‘free_foos_list’
|
+--> ‘free_foo’: events 11-15
|
| 53 | free_foo (foo *f)
| | ^~~~~~~~
| | |
| | (11) entry to ‘free_foo’
| 54 | {
| 55 | if (!f) return;
| | ~
| | |
| | (12) following ‘false’ branch (when ‘f’ is non-NULL)...
| 56 | if (f->name) free (f->name);
| | ~~~~~~~~ ~~~~~~~
| | | | |
| | | | (15) ...to here
| | | (13) ...to here
| | (14) following ‘true’ branch...
|
<------+
|
‘free_foos_list’: events 16-19
|
| 78 | for (size_t i = 0; i < l->foos_len; i++)
| | ~~~
| | |
| | (17) following ‘true’ branch...
| 79 | free_foo (l->foos[i]);
| | ^~~~~~~~~~~~~~~~~~~~~
| | | |
| | | (18) ...to here
| | (16) returning to ‘free_foos_list’ from ‘free_foo’
| | (19) calling ‘free_foo’ from ‘free_foos_list’
|
+--> ‘free_foo’: events 20-25
|
| 53 | free_foo (foo *f)
| | ^~~~~~~~
| | |
| | (20) entry to ‘free_foo’
| 54 | {
| 55 | if (!f) return;
| | ~
| | |
| | (21) following ‘false’ branch (when ‘f’ is non-NULL)...
| 56 | if (f->name) free (f->name);
| | ~~~~~~~~ ~~~~~~~~~~~~~~
| | | | | |
| | | | | (24) ...to here
| | | | (25) second ‘free’ here
| | | (22) ...to here
| | (23) following ‘true’ branch...
|
cc1: all warnings being treated as errors
If I understand correctly, it complains that I use f->name after freeing f, except that when I follow its instructions, the foo freed is l->foos[0] and the one the analyzer think is already freed is l->foos[1] (and it is not freed yet).
What puzzles me even more is that if I actually use those functions, the errors disappear. Here is a main function using them, and if I replace the main function with it in the previous file, it compiles just fine:
int main()
{
foos_list *l = new_foos_list ();
foo *f = new_foo ();
foo *f2 = new_foo ();
l->foos_len++;
l->foos = xrealloc (l->foos, sizeof(foo) * l->foos_len);
l->foos[0] = f;
l->foos_len++;
l->foos = xrealloc (l->foos, sizeof(foo) * l->foos_len);
l->foos[1] = f2;
free_foos_list (l);
}
My problem is that of course, I don't want to allocate and free foos, I hit that problem in a more complexe program where the functions are used in a different file they are declared, and the same fanalyzer errors are triggered.
So my question is : is this a fanalyzer bug (and if so, is there a workaround), or is it an error on my side (and how to fix it)? Thanks.

Answer 1

It seems to be an -fanalyzer issue.
I desk checked your code and found no leak.
My version of gcc doesn't seem to support -fanalyzer, so I couldn't test that.
I downloaded and built your program and ran it under valgrind. I did this for your original main and one I created with a more extensive diagnostic.
They both reported no errors of any kind.
Note that you're allocating too much space (wasteful, but harmless):
l->foos = xrealloc(l->foos,sizeof(foo) * l->foos_len);
Should be:
l->foos = xrealloc(l->foos,sizeof(foo *) * l->foos_len);
Or, better yet:
l->foos = xrealloc(l->foos,sizeof(*l->foos) * l->foos_len);
Here's my version:
#define _GNU_SOURCE
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void *
xalloc(size_t len)
{
void *mem = malloc(len);
if (!mem) {
fprintf(stderr, "can't allocated memory");
exit(1);
}
return mem;
}
void *
xrealloc(void *mem, size_t msize)
{
mem = realloc(mem, msize);
if (!mem) {
fprintf(stderr, "can't allocate %zu bytes of memory\n", msize);
exit(1);
}
return mem;
}
typedef struct {
char *name;
} foo;
typedef struct {
foo **foos;
size_t foos_len;
} foos_list;
foo *
new_foo()
{
foo *f = xalloc(sizeof(foo));
f->name = NULL;
return f;
}
void
free_foo(foo *f)
{
if (!f)
return;
if (f->name)
free(f->name);
free(f);
}
foos_list *
new_foos_list(void)
{
foos_list *l = xalloc(sizeof(foos_list));
l->foos = NULL;
l->foos_len = 0;
return l;
}
void
free_foos_list(foos_list *l)
{
if (! l)
return;
if (l->foos) {
for (size_t i = 0; i < l->foos_len; i++)
free_foo(l->foos[i]);
free(l->foos);
}
free(l);
}
int
main()
{
char name[100];
foos_list *l = new_foos_list();
for (int idx = 0; idx < 30; ++idx) {
foo *f = new_foo();
sprintf(name,"N%d",idx);
f->name = strdup(name);
size_t count = l->foos_len++;
l->foos = xrealloc(l->foos,sizeof(*l->foos) * (count + 1));
l->foos[count] = f;
}
int totlen = 0;
for (int idx = 0; idx < l->foos_len; ++idx) {
foo *f = l->foos[idx];
totlen += printf(" %s",f->name);
if (totlen > 70) {
printf("\n");
totlen = 0;
}
}
printf("\n");
free_foos_list(l);
return 0;
}
Here's the my version's output:
N0 N1 N2 N3 N4 N5 N6 N7 N8 N9 N10 N11 N12 N13 N14 N15 N16 N17 N18 N19 N20
N21 N22 N23 N24 N25 N26 N27 N28 N29