diff --git a/clang/lib/Sema/AnalysisBasedWarnings.cpp b/clang/lib/Sema/AnalysisBasedWarnings.cpp index c76733e9a774b..95d14c492e1ea 100644 --- a/clang/lib/Sema/AnalysisBasedWarnings.cpp +++ b/clang/lib/Sema/AnalysisBasedWarnings.cpp @@ -2270,19 +2270,28 @@ class UnsafeBufferUsageReporter : public UnsafeBufferUsageHandler { MsgParam = 5; } else if (const auto *ECE = dyn_cast(Operation)) { QualType destType = ECE->getType(); + bool destTypeComplete = true; + if (!isa(destType)) return; + destType = destType.getTypePtr()->getPointeeType(); + if (const auto *D = destType->getAsTagDecl()) + destTypeComplete = D->isCompleteDefinition(); - const uint64_t dSize = - Ctx.getTypeSize(destType.getTypePtr()->getPointeeType()); + // If destination type is incomplete, it is unsafe to cast to anyway, no + // need to check its type: + if (destTypeComplete) { + const uint64_t dSize = Ctx.getTypeSize(destType); + QualType srcType = ECE->getSubExpr()->getType(); - QualType srcType = ECE->getSubExpr()->getType(); - const uint64_t sSize = - Ctx.getTypeSize(srcType.getTypePtr()->getPointeeType()); + assert(srcType->isPointerType()); - if (sSize >= dSize) - return; + const uint64_t sSize = + Ctx.getTypeSize(srcType.getTypePtr()->getPointeeType()); + if (sSize >= dSize) + return; + } if (const auto *CE = dyn_cast( ECE->getSubExpr()->IgnoreParens())) { D = CE->getMethodDecl(); diff --git a/clang/test/SemaCXX/warn-unsafe-buffer-usage-warning-data-invocation.cpp b/clang/test/SemaCXX/warn-unsafe-buffer-usage-warning-data-invocation.cpp index 0228e42652bd9..a6a334d247023 100644 --- a/clang/test/SemaCXX/warn-unsafe-buffer-usage-warning-data-invocation.cpp +++ b/clang/test/SemaCXX/warn-unsafe-buffer-usage-warning-data-invocation.cpp @@ -173,4 +173,21 @@ A false_negatives(std::span span_pt, span span_A) { return *a2; // TODO: Can cause OOB if span_pt is empty } + +void test_incomplete_type(std::span S) { + (struct IncompleteStruct *)S.data(); // expected-warning{{unsafe invocation of 'data'}} + (class IncompleteClass *)S.data(); // expected-warning{{unsafe invocation of 'data'}} + (union IncompleteUnion *)S.data(); // expected-warning{{unsafe invocation of 'data'}} +} + +void test_complete_type(std::span S) { + (struct CompleteStruct *)S.data(); // no warn as the struct size is smaller than long + (class CompleteClass *)S.data(); // no warn as the class size is smaller than long + (union CompleteUnion *)S.data(); // no warn as the union size is smaller than long + + struct CompleteStruct {}; + class CompleteClass {}; + union CompleteUnion {}; +} + #endif