#962772 valgrind thinks that size_t is signed

Package:
valgrind
Source:
valgrind
Description:
instrumentation framework for building dynamic analysis tools
Submitter:
Vincent Lefevre
Date:
2025-04-14 21:15:02 UTC
Severity:
normal
Tags:
#962772#5
Date:
2020-06-13 18:06:26 UTC
From:
To:
When testing GNU MPFR with valgrind:

FAIL: tabort_defalloc1
======================

[tabort_defalloc1] Check for good handling of abort in memory function.
==3948670== Argument 'size' of function malloc has a fishy (possibly negative) value: -1
==3948670==    at 0x483677F: malloc (vg_replace_malloc.c:309)
==3948670==    by 0x10C453: mpfr_default_allocate (memory.c:69)
==3948670==    by 0x10C453: tests_allocate (memory.c:162)
==3948670==    by 0x488A18F: mpfr_allocate_func (mpfr-gmp.c:315)
==3948670==    by 0x10A485: main (tabort_defalloc1.c:43)
==3948670==
[MPFR] mpfr_default_allocate(): can't allocate memory (size=18446744073709551615)
FAIL tabort_defalloc1 (exit status: 1)

FAIL: tabort_defalloc2
======================

[tabort_defalloc2] Check for good handling of abort in memory function.
==3948672== Argument 'size' of function realloc has a fishy (possibly negative) value: -1
==3948672==    at 0x4838D7B: realloc (vg_replace_malloc.c:836)
==3948672==    by 0x10C552: mpfr_default_reallocate (memory.c:84)
==3948672==    by 0x10C552: tests_reallocate (memory.c:213)
==3948672==    by 0x10C552: tests_reallocate (memory.c:174)
==3948672==    by 0x488A1F0: mpfr_reallocate_func (mpfr-gmp.c:326)
==3948672==    by 0x10A4A7: main (tabort_defalloc2.c:46)
==3948672==
[MPFR] mpfr_default_reallocate(): can't reallocate memory (old_size=128 new_size=18446744073709551615)
FAIL tabort_defalloc2 (exit status: 1)

The malloc / realloc argument is of type size_t, which is unsigned
according to the C standard, thus cannot be negative!

#962772#10
Date:
2024-12-28 02:55:44 UTC
From:
To:
Control: found -1 1:3.19.0-1
[...]

Note that this is no longer reproducible with the latest version of
the MPFR (or perhaps I need to pass some specific configure options,
I don't remember...). Anyway, the issue is still reproducible with a
simple testcase:

#include <stdlib.h>
int main (void)
{
  void *p = malloc ((size_t) -1);
  return p != NULL;
}

qaa% gcc-snapshot tst.c -o tst
tst.c: In function 'main':
tst.c:4:13: warning: argument 1 value '18446744073709551615' exceeds maximum object size 9223372036854775807 [-Walloc-size-larger-than=]
    4 |   void *p = malloc ((size_t) -1);
      |             ^~~~~~~~~~~~~~~~~~~~
In file included from tst.c:1:
/usr/include/stdlib.h:672:14: note: in a call to allocation function 'malloc' declared here
  672 | extern void *malloc (size_t __size) __THROW __attribute_malloc__
      |              ^~~~~~
qaa% valgrind ./tst
[...]
==1153312== Argument 'size' of function malloc has a fishy (possibly negative) value: -1
==1153312==    at 0x48437B4: malloc (vg_replace_malloc.c:381)
==1153312==    by 0x401139: main (in /home/vinc17/tst)
[...]

GCC is right about the value (a very large positive value) in its
warning, but valgrind is still wrong as seeing it as negative.

#962772#17
Date:
2024-12-28 11:28:19 UTC
From:
To:
Control: tags -1 upstream
Control: forwarded -1 https://bugs.kde.org/show_bug.cgi?id=497977

The reason is that the concerned MPFR tests are now automatically
disabled when they are run under valgrind.
[...]

I've just reported the bug upstream, with this simple testcase.