-Wanalyzer-out-of-bounds and -Wanalyzer-possible-null-dereference warnings in SDK (gcc 14.2) #2612
Description
After update to pico-SDK ver. 2.2, there were some warnings thrown when using the -fanalyzer option. Granted, these are warnings, but it would be worth another check to ensure that's all they are, and they may be worth correcting if they are valid.
My OS is openSUSE Tumbleweed and the compiler is arm-none-eabi-gcc14:
$ arm-none-eabi-gcc --version
arm-none-eabi-gcc (openSUSE 14.2.0-1.77) 14 20241119
Copyright (C) 2024 Free Software Foundation, Inc.
The pico-SDK is current master for the 2.2 version:
$ picotool info -a spi-74hc595-led.elf
File spi-74hc595-led.elf:
Program Information
name: spi-74hc595-led
version: 0.0.1
features: UART stdin / stdout
binary start: 0x10000000
binary end: 0x1000567c
Fixed Pin Information
0: UART0 TX
1: UART0 RX
Build Information
sdk version: 2.2.0
pico_board: pico
boot2_name: boot2_w25q080
build date: Jul 31 2025
build attributes: Release
Metadata Blocks
none
This build uses the hardware adc, pwm and spi libraries. The build output with warnings is:
make
[ 2%] Built target bs2_default
[ 7%] Built target bs2_default_library
[ 8%] Building C object CMakeFiles/spi-74hc595-led.dir/src/spi-74hc595-led.c.o
[ 10%] Building C object CMakeFiles/spi-74hc595-led.dir/src/hc595-led.c.o
[ 11%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_stdlib/stdlib.c.o
[ 13%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_gpio/gpio.c.o
[ 14%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2040/pico_platform/platform.c.o
[ 16%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_platform_common/common.c.o
[ 17%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_platform_panic/panic.c.o
[ 19%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/common/hardware_claim/claim.c.o
[ 20%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_sync/sync.c.o
[ 22%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_sync_spin_lock/sync_spin_lock.c.o
[ 23%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_irq/irq.c.o
[ 25%] Building ASM object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_irq/irq_handler_chain.S.o
[ 26%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/common/pico_sync/sem.c.o
[ 27%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/common/pico_sync/lock_core.c.o
[ 29%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/common/pico_sync/mutex.c.o
/opt/pico-sdk/src/common/pico_sync/mutex.c: In function 'mutex_init':
/opt/pico-sdk/src/common/pico_sync/mutex.c:45:16: warning: buffer overflow [CWE-787] [-Wanalyzer-out-of-bounds]
45 | mtx->owner = LOCK_INVALID_OWNER_ID;
| ^
event 1
|
| 21 | extern lock_core_t __mutex_array_start;
| | ^~~~~~~~~~~~~~~~~~~
| | |
| | (1) capacity: 4 bytes
|
+--> 'runtime_init_mutex': event 2
|
|/opt/pico-sdk/src/common/pico_sync/include/pico/mutex.h:308:6:
| 308 | void runtime_init_mutex(void);
| | ^~~~~~~~~~~~~~~~~~
| | |
| | (2) entry to 'runtime_init_mutex'
|
'runtime_init_mutex': events 3-7
|
|/opt/pico-sdk/src/common/pico_sync/mutex.c:24:51:
| 24 | for (lock_core_t *l = &__mutex_array_start; l < &__mutex_array_end; ) {
| | ~~^~~~~~~~~~~~~~~~~~~~
| | |
| | (3) following 'true' branch...
| 25 | if (l->spin_lock) {
| | ~~~~~~~~~~~~~
| | | |
| | | (4) ...to here
| | (5) following 'false' branch...
|......
| 32 | mutex_init(m);
| | ~~~~~~~~~~~~~
| | |
| | (6) ...to here
| | (7) calling 'mutex_init' from 'runtime_init_mutex'
|
+--> 'mutex_init': event 8
|
|/opt/pico-sdk/src/common/pico_sync/include/pico/mutex.h:73:6:
| 73 | void mutex_init(mutex_t *mtx);
| | ^~~~~~~~~~
| | |
| | (8) entry to 'mutex_init'
|
'mutex_init': event 9
|
|/opt/pico-sdk/src/common/pico_sync/mutex.c:45:16:
| 45 | mtx->owner = LOCK_INVALID_OWNER_ID;
| | ^
| | |
| | (9) out-of-bounds write at byte 4 but '__mutex_array_start' ends at byte 4
|
/opt/pico-sdk/src/common/pico_sync/mutex.c:45:16: note: write of 1 byte to beyond the end of '__mutex_array_start'
┌───────────────────────────┐
│write of '(signed char) -1'│
└───────────────────────────┘
│
│
v
┌──────────────────────────────────────────────────┐┌───────────────────────────┐
│'__mutex_array_start' (type: 'struct lock_core_t')││ after valid range │
└──────────────────────────────────────────────────┘└───────────────────────────┘
├────────────────────────┬─────────────────────────┤├─────────────┬─────────────┤
│ │
╭────────┴────────╮ ╭──────────┴──────────╮
│capacity: 4 bytes│ │⚠ overflow of 1 byte│
╰─────────────────╯ ╰─────────────────────╯
/opt/pico-sdk/src/common/pico_sync/mutex.c: In function 'recursive_mutex_init':
/opt/pico-sdk/src/common/pico_sync/mutex.c:54:16: warning: buffer overflow [CWE-787] [-Wanalyzer-out-of-bounds]
54 | mtx->owner = LOCK_INVALID_OWNER_ID;
| ^
event 1
|
| 21 | extern lock_core_t __mutex_array_start;
| | ^~~~~~~~~~~~~~~~~~~
| | |
| | (1) capacity: 4 bytes
|
+--> 'runtime_init_mutex': event 2
|
|/opt/pico-sdk/src/common/pico_sync/include/pico/mutex.h:308:6:
| 308 | void runtime_init_mutex(void);
| | ^~~~~~~~~~~~~~~~~~
| | |
| | (2) entry to 'runtime_init_mutex'
|
'runtime_init_mutex': events 3-7
|
|/opt/pico-sdk/src/common/pico_sync/mutex.c:24:51:
| 24 | for (lock_core_t *l = &__mutex_array_start; l < &__mutex_array_end; ) {
| | ~~^~~~~~~~~~~~~~~~~~~~
| | |
| | (3) following 'true' branch...
| 25 | if (l->spin_lock) {
| | ~~~~~~~~~~~~~
| | | |
| | | (4) ...to here
| | (5) following 'true' branch...
|......
| 28 | recursive_mutex_init(rm);
| | ~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (6) ...to here
| | (7) calling 'recursive_mutex_init' from 'runtime_init_mutex'
|
+--> 'recursive_mutex_init': event 8
|
|/opt/pico-sdk/src/common/pico_sync/include/pico/mutex.h:82:6:
| 82 | void recursive_mutex_init(recursive_mutex_t *mtx);
| | ^~~~~~~~~~~~~~~~~~~~
| | |
| | (8) entry to 'recursive_mutex_init'
|
'recursive_mutex_init': event 9
|
|/opt/pico-sdk/src/common/pico_sync/mutex.c:54:16:
| 54 | mtx->owner = LOCK_INVALID_OWNER_ID;
| | ^
| | |
| | (9) out-of-bounds write at byte 4 but '__mutex_array_start' ends at byte 4
|
/opt/pico-sdk/src/common/pico_sync/mutex.c:54:16: note: write of 1 byte to beyond the end of '__mutex_array_start'
┌───────────────────────────┐
│write of '(signed char) -1'│
└───────────────────────────┘
│
│
v
┌──────────────────────────────────────────────────┐┌───────────────────────────┐
│'__mutex_array_start' (type: 'struct lock_core_t')││ after valid range │
└──────────────────────────────────────────────────┘└───────────────────────────┘
├────────────────────────┬─────────────────────────┤├─────────────┬─────────────┤
│ │
╭────────┴────────╮ ╭──────────┴──────────╮
│capacity: 4 bytes│ │⚠ overflow of 1 byte│
╰─────────────────╯ ╰─────────────────────╯
/opt/pico-sdk/src/common/pico_sync/mutex.c:55:22: warning: buffer overflow [CWE-787] [-Wanalyzer-out-of-bounds]
55 | mtx->enter_count = 0;
| ~~~~~~~~~~~~~~~~~^~~
event 1
|
| 21 | extern lock_core_t __mutex_array_start;
| | ^~~~~~~~~~~~~~~~~~~
| | |
| | (1) capacity: 4 bytes
|
+--> 'runtime_init_mutex': event 2
|
|/opt/pico-sdk/src/common/pico_sync/include/pico/mutex.h:308:6:
| 308 | void runtime_init_mutex(void);
| | ^~~~~~~~~~~~~~~~~~
| | |
| | (2) entry to 'runtime_init_mutex'
|
'runtime_init_mutex': events 3-7
|
|/opt/pico-sdk/src/common/pico_sync/mutex.c:24:51:
| 24 | for (lock_core_t *l = &__mutex_array_start; l < &__mutex_array_end; ) {
| | ~~^~~~~~~~~~~~~~~~~~~~
| | |
| | (3) following 'true' branch...
| 25 | if (l->spin_lock) {
| | ~~~~~~~~~~~~~
| | | |
| | | (4) ...to here
| | (5) following 'true' branch...
|......
| 28 | recursive_mutex_init(rm);
| | ~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (6) ...to here
| | (7) calling 'recursive_mutex_init' from 'runtime_init_mutex'
|
+--> 'recursive_mutex_init': event 8
|
|/opt/pico-sdk/src/common/pico_sync/include/pico/mutex.h:82:6:
| 82 | void recursive_mutex_init(recursive_mutex_t *mtx);
| | ^~~~~~~~~~~~~~~~~~~~
| | |
| | (8) entry to 'recursive_mutex_init'
|
'recursive_mutex_init': event 9
|
|/opt/pico-sdk/src/common/pico_sync/mutex.c:55:22:
| 55 | mtx->enter_count = 0;
| | ~~~~~~~~~~~~~~~~~^~~
| | |
| | (9) out-of-bounds write at byte 5 but '__mutex_array_start' ends at byte 4
|
/opt/pico-sdk/src/common/pico_sync/mutex.c:55:22: note: write of 1 byte to beyond the end of '__mutex_array_start'
┌──────────────────────┐
│write of '(uint8_t) 0'│
└──────────────────────┘
│
│
v
┌──────────────────────────────────────────────────┐ ┌──────────────────────┐
│'__mutex_array_start' (type: 'struct lock_core_t')│ │ after valid range │
└──────────────────────────────────────────────────┘ └──────────────────────┘
├────────────────────────┬─────────────────────────┤├┤├──────────┬───────────┤
│ │ │
│ │ ╭──────────┴──────────╮
│ │ │⚠ overflow of 1 byte│
│ │ ╰─────────────────────╯
╭────────┴────────╮ ╭───┴──╮
│capacity: 4 bytes│ │1 byte│
╰─────────────────╯ ╰──────╯
[ 30%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/common/pico_sync/critical_section.c.o
[ 32%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/common/pico_time/time.c.o
/opt/pico-sdk/src/common/pico_time/time.c: In function 'alarm_pool_post_alloc_init':
/opt/pico-sdk/src/common/pico_time/time.c:291:31: warning: dereference of possibly-NULL '*pool.entries + i * 24' [CWE-690] [-Wanalyzer-possible-null-dereference]
291 | pool->entries[i].next = (int16_t)(i-1);
| ~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~
'alarm_pool_create_on_timer_with_unused_hardware_alarm': event 1
|
|/opt/pico-sdk/src/common/pico_time/include/pico/time.h:429:15:
| 429 | alarm_pool_t *alarm_pool_create_on_timer_with_unused_hardware_alarm(alarm_pool_timer_t *timer, uint max_timers);
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (1) entry to 'alarm_pool_create_on_timer_with_unused_hardware_alarm'
|
'alarm_pool_create_on_timer_with_unused_hardware_alarm': events 2-5
|
|/opt/pico-sdk/src/common/pico_time/time.c:123:8:
| 123 | if (pool) {
| | ^
| | |
| | (2) following 'true' branch (when 'pool' is non-NULL)...
| 124 | pool->entries = (alarm_pool_entry_t *) calloc(max_timers, sizeof(alarm_pool_entry_t));
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (3) ...to here
| | (4) this call could return NULL
| 125 | alarm_pool_post_alloc_init(pool, timer, (uint) ta_hardware_alarm_claim_unused(timer, true), max_timers);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (5) calling 'alarm_pool_post_alloc_init' from 'alarm_pool_create_on_timer_with_unused_hardware_alarm'
|
+--> 'alarm_pool_post_alloc_init': events 6-9
|
| 281 | void alarm_pool_post_alloc_init(alarm_pool_t *pool, alarm_pool_timer_t *timer, uint hardware_alarm_num, uint max_timers) {
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (6) entry to 'alarm_pool_post_alloc_init'
|......
| 290 | for(uint i=0;i<max_timers;i++) {
| | ~~~~~~~~~~~~
| | |
| | (7) following 'true' branch (when 'i < max_timers')...
| 291 | pool->entries[i].next = (int16_t)(i-1);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | | |
| | | (8) ...to here
| | (9) '*pool.entries + i * 24' could be NULL: unchecked value from (4)
|
[ 33%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/common/pico_time/timeout_helper.c.o
[ 35%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_timer/timer.c.o
[ 36%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/common/pico_util/datetime.c.o
[ 38%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/common/pico_util/pheap.c.o
[ 39%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/common/pico_util/queue.c.o
[ 41%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_uart/uart.c.o
[ 42%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_clocks/clocks.c.o
[ 44%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_pll/pll.c.o
[ 45%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_vreg/vreg.c.o
[ 47%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_watchdog/watchdog.c.o
[ 48%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_ticks/ticks.c.o
[ 50%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_bootrom/bootrom.c.o
[ 51%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_bootrom/bootrom_lock.c.o
[ 52%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_boot_lock/boot_lock.c.o
[ 54%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_flash/flash.c.o
[ 55%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_xosc/xosc.c.o
[ 57%] Building ASM object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_divider/divider.S.o
[ 58%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_runtime/runtime.c.o
[ 60%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_runtime_init/runtime_init.c.o
[ 61%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_runtime_init/runtime_init_clocks.c.o
[ 63%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_runtime_init/runtime_init_stack_guard.c.o
[ 64%] Building ASM object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_bit_ops/bit_ops_aeabi.S.o
[ 66%] Building ASM object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_divider/divider_hardware.S.o
[ 67%] Building ASM object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_double/double_aeabi_rp2040.S.o
[ 69%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_double/double_init_rom_rp2040.c.o
[ 70%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_double/double_math.c.o
[ 72%] Building ASM object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_double/double_v1_rom_shim_rp2040.S.o
[ 73%] Building ASM object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_int64_ops/pico_int64_ops_aeabi.S.o
[ 75%] Building ASM object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_float/float_aeabi_rp2040.S.o
[ 76%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_float/float_init_rom_rp2040.c.o
[ 77%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_float/float_math.c.o
[ 79%] Building ASM object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_float/float_v1_rom_shim_rp2040.S.o
[ 80%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_malloc/malloc.c.o
[ 82%] Building ASM object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_mem_ops/mem_ops_aeabi.S.o
[ 83%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_atomic/atomic.c.o
[ 85%] Building CXX object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_cxx_options/new_delete.cpp.o
[ 86%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_standard_binary_info/standard_binary_info.c.o
[ 88%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_printf/printf.c.o
[ 89%] Building ASM object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_crt0/crt0.S.o
[ 91%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_clib_interface/newlib_interface.c.o
[ 92%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_stdio/stdio.c.o
[ 94%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/pico_stdio_uart/stdio_uart.c.o
[ 95%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_spi/spi.c.o
[ 97%] Building C object CMakeFiles/spi-74hc595-led.dir/opt/pico-sdk/src/rp2_common/hardware_adc/adc.c.o
[ 98%] Linking CXX executable spi-74hc595-led.elf
Memory region Used Size Region Size %age Used
FLASH: 22140 B 2 MB 1.06%
RAM: 4136 B 256 KB 1.58%
SCRATCH_X: 0 B 4 KB 0.00%
SCRATCH_Y: 2 KB 4 KB 50.00%
[100%] Built target spi-74hc595-led
These are just warnings, and at least for the single-core builds I'm doing don't seem to be pointing to any actual out of bounds or null dereference. But they were prominent enough that I thought I would take the time to open an issue to track them. This is more a pedantic thing from years of preaching "never accept code until it compiles without warning".
Let me know if you need anything else from the build. GCC is quite detailed on the warning identification, so it's not a question of where they are being triggered. I'm happy to provide anything needed.
Ver. 2.2 of the SDK is working fine.