Bug Summary

File:src/lib/libm/src/e_rem_pio2f.c
Warning:line 172, column 16
The left operand of '==' is a garbage value due to array index out of bounds

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name e_rem_pio2f.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/lib/libm/obj -resource-dir /usr/local/lib/clang/13.0.0 -include namespace.h -I /usr/src/lib/libm/arch/amd64 -I /usr/src/lib/libm/src -I /usr/src/lib/libm/src/ld80 -I /usr/src/lib/libm/hidden -D PIC -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/lib/libm/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/lib/libm/src/e_rem_pio2f.c
1/* e_rem_pio2f.c -- float version of e_rem_pio2.c
2 * Conversion to float by Ian Lance Taylor, Cygnus Support, ian@cygnus.com.
3 */
4
5/*
6 * ====================================================
7 * Copyright (C) 1993 by Sun Microsystems, Inc. All rights reserved.
8 *
9 * Developed at SunPro, a Sun Microsystems, Inc. business.
10 * Permission to use, copy, modify, and distribute this
11 * software is freely granted, provided that this notice
12 * is preserved.
13 * ====================================================
14 */
15
16/* __ieee754_rem_pio2f(x,y)
17 *
18 * return the remainder of x rem pi/2 in y[0]+y[1]
19 * use __kernel_rem_pio2f()
20 */
21
22#include "math.h"
23#include "math_private.h"
24
25/*
26 * Table of constants for 2/pi, 396 Hex digits (476 decimal) of 2/pi
27 */
28static const int32_t two_over_pi[] = {
290xA2, 0xF9, 0x83, 0x6E, 0x4E, 0x44, 0x15, 0x29, 0xFC,
300x27, 0x57, 0xD1, 0xF5, 0x34, 0xDD, 0xC0, 0xDB, 0x62,
310x95, 0x99, 0x3C, 0x43, 0x90, 0x41, 0xFE, 0x51, 0x63,
320xAB, 0xDE, 0xBB, 0xC5, 0x61, 0xB7, 0x24, 0x6E, 0x3A,
330x42, 0x4D, 0xD2, 0xE0, 0x06, 0x49, 0x2E, 0xEA, 0x09,
340xD1, 0x92, 0x1C, 0xFE, 0x1D, 0xEB, 0x1C, 0xB1, 0x29,
350xA7, 0x3E, 0xE8, 0x82, 0x35, 0xF5, 0x2E, 0xBB, 0x44,
360x84, 0xE9, 0x9C, 0x70, 0x26, 0xB4, 0x5F, 0x7E, 0x41,
370x39, 0x91, 0xD6, 0x39, 0x83, 0x53, 0x39, 0xF4, 0x9C,
380x84, 0x5F, 0x8B, 0xBD, 0xF9, 0x28, 0x3B, 0x1F, 0xF8,
390x97, 0xFF, 0xDE, 0x05, 0x98, 0x0F, 0xEF, 0x2F, 0x11,
400x8B, 0x5A, 0x0A, 0x6D, 0x1F, 0x6D, 0x36, 0x7E, 0xCF,
410x27, 0xCB, 0x09, 0xB7, 0x4F, 0x46, 0x3F, 0x66, 0x9E,
420x5F, 0xEA, 0x2D, 0x75, 0x27, 0xBA, 0xC7, 0xEB, 0xE5,
430xF1, 0x7B, 0x3D, 0x07, 0x39, 0xF7, 0x8A, 0x52, 0x92,
440xEA, 0x6B, 0xFB, 0x5F, 0xB1, 0x1F, 0x8D, 0x5D, 0x08,
450x56, 0x03, 0x30, 0x46, 0xFC, 0x7B, 0x6B, 0xAB, 0xF0,
460xCF, 0xBC, 0x20, 0x9A, 0xF4, 0x36, 0x1D, 0xA9, 0xE3,
470x91, 0x61, 0x5E, 0xE6, 0x1B, 0x08, 0x65, 0x99, 0x85,
480x5F, 0x14, 0xA0, 0x68, 0x40, 0x8D, 0xFF, 0xD8, 0x80,
490x4D, 0x73, 0x27, 0x31, 0x06, 0x06, 0x15, 0x56, 0xCA,
500x73, 0xA8, 0xC9, 0x60, 0xE2, 0x7B, 0xC0, 0x8C, 0x6B,
51};
52
53/* This array is like the one in e_rem_pio2.c, but the numbers are
54 single precision and the last 8 bits are forced to 0. */
55static const int32_t npio2_hw[] = {
560x3fc90f00, 0x40490f00, 0x4096cb00, 0x40c90f00, 0x40fb5300, 0x4116cb00,
570x412fed00, 0x41490f00, 0x41623100, 0x417b5300, 0x418a3a00, 0x4196cb00,
580x41a35c00, 0x41afed00, 0x41bc7e00, 0x41c90f00, 0x41d5a000, 0x41e23100,
590x41eec200, 0x41fb5300, 0x4203f200, 0x420a3a00, 0x42108300, 0x4216cb00,
600x421d1400, 0x42235c00, 0x4229a500, 0x422fed00, 0x42363600, 0x423c7e00,
610x4242c700, 0x42490f00
62};
63
64/*
65 * invpio2: 24 bits of 2/pi
66 * pio2_1: first 17 bit of pi/2
67 * pio2_1t: pi/2 - pio2_1
68 * pio2_2: second 17 bit of pi/2
69 * pio2_2t: pi/2 - (pio2_1+pio2_2)
70 * pio2_3: third 17 bit of pi/2
71 * pio2_3t: pi/2 - (pio2_1+pio2_2+pio2_3)
72 */
73
74static const float
75zero = 0.0000000000e+00, /* 0x00000000 */
76half = 5.0000000000e-01, /* 0x3f000000 */
77two8 = 2.5600000000e+02, /* 0x43800000 */
78invpio2 = 6.3661980629e-01, /* 0x3f22f984 */
79pio2_1 = 1.5707855225e+00, /* 0x3fc90f80 */
80pio2_1t = 1.0804334124e-05, /* 0x37354443 */
81pio2_2 = 1.0804273188e-05, /* 0x37354400 */
82pio2_2t = 6.0770999344e-11, /* 0x2e85a308 */
83pio2_3 = 6.0770943833e-11, /* 0x2e85a300 */
84pio2_3t = 6.1232342629e-17; /* 0x248d3132 */
85
86int32_t
87__ieee754_rem_pio2f(float x, float *y)
88{
89 float z,w,t,r,fn;
90 float tx[3];
91 int32_t e0,i,j,nx,n,ix,hx;
92
93 GET_FLOAT_WORD(hx,x)do { ieee_float_shape_type gf_u; gf_u.value = (x); (hx) = gf_u
.word; } while (0);
1
Loop condition is false. Exiting loop
→
94 ix = hx&0x7fffffff;
95 if(ix<=0x3f490fd8) /* |x| ~<= pi/4 , no need for reduction */
2
←
Assuming 'ix' is > 1061752792
→
3
←
Taking false branch
→
96 {y[0] = x; y[1] = 0; return 0;}
97 if(ix<0x4016cbe4) { /* |x| < 3pi/4, special case with n=+-1 */
4
←
Assuming 'ix' is >= 1075235812
→
5
←
Taking false branch
→
98 if(hx>0) {
99 z = x - pio2_1;
100 if((ix&0xfffffff0)!=0x3fc90fd0) { /* 24+24 bit pi OK */
101 y[0] = z - pio2_1t;
102 y[1] = (z-y[0])-pio2_1t;
103 } else { /* near pi/2, use 24+24+24 bit pi */
104 z -= pio2_2;
105 y[0] = z - pio2_2t;
106 y[1] = (z-y[0])-pio2_2t;
107 }
108 return 1;
109 } else { /* negative x */
110 z = x + pio2_1;
111 if((ix&0xfffffff0)!=0x3fc90fd0) { /* 24+24 bit pi OK */
112 y[0] = z + pio2_1t;
113 y[1] = (z-y[0])+pio2_1t;
114 } else { /* near pi/2, use 24+24+24 bit pi */
115 z += pio2_2;
116 y[0] = z + pio2_2t;
117 y[1] = (z-y[0])+pio2_2t;
118 }
119 return -1;
120 }
121 }
122 if(ix<=0x43490f80) { /* |x| ~<= 2^7*(pi/2), medium size */
6
←
Assuming 'ix' is > 1128861568
→
7
←
Taking false branch
→
123 t = fabsf(x);
124 n = (int32_t) (t*invpio2+half);
125 fn = (float)n;
126 r = t-fn*pio2_1;
127 w = fn*pio2_1t; /* 1st round good to 40 bit */
128 if(n<32&&(ix&0xffffff00)!=npio2_hw[n-1]) {
129 y[0] = r-w; /* quick check no cancellation */
130 } else {
131 u_int32_t high;
132 j = ix>>23;
133 y[0] = r-w;
134 GET_FLOAT_WORD(high,y[0])do { ieee_float_shape_type gf_u; gf_u.value = (y[0]); (high) =
gf_u.word; } while (0);
135 i = j-((high>>23)&0xff);
136 if(i>8) { /* 2nd iteration needed, good to 57 */
137 t = r;
138 w = fn*pio2_2;
139 r = t-w;
140 w = fn*pio2_2t-((t-r)-w);
141 y[0] = r-w;
142 GET_FLOAT_WORD(high,y[0])do { ieee_float_shape_type gf_u; gf_u.value = (y[0]); (high) =
gf_u.word; } while (0);
143 i = j-((high>>23)&0xff);
144 if(i>25) { /* 3rd iteration need, 74 bits acc */
145 t = r; /* will cover all possible cases */
146 w = fn*pio2_3;
147 r = t-w;
148 w = fn*pio2_3t-((t-r)-w);
149 y[0] = r-w;
150 }
151 }
152 }
153 y[1] = (r-y[0])-w;
154 if(hx<0) {y[0] = -y[0]; y[1] = -y[1]; return -n;}
155 else return n;
156 }
157 /*
158 * all other (large) arguments
159 */
160 if(ix>=0x7f800000) { /* x is inf or NaN */
8
←
Assuming 'ix' is < 2139095040
→
9
←
Taking false branch
→
161 y[0]=y[1]=x-x; return 0;
162 }
163 /* set z = scalbn(|x|,ilogb(x)-7) */
164 e0 = (ix>>23)-134; /* e0 = ilogb(z)-7; */
165 SET_FLOAT_WORD(z, ix - ((int32_t)(e0<<23)))do { ieee_float_shape_type sf_u; sf_u.word = (ix - ((int32_t)
(e0<<23))); (z) = sf_u.value; } while (0);
10
←
Loop condition is false. Exiting loop
→
166 for(i=0;i<2;i++) {
11
←
Loop condition is true. Entering loop body
→
12
←
Loop condition is true. Entering loop body
→
13
←
Loop condition is false. Execution continues on line 170
→
167 tx[i] = (float)((int32_t)(z));
168 z = (z-tx[i])*two8;
169 }
170 tx[2] = z;
171 nx = 3;
172 while(tx[nx-1]==zero) nx--; /* skip zero term */
14
←
Loop condition is true. Entering loop body
→
15
←
Loop condition is true. Entering loop body
→
16
←
Loop condition is true. Entering loop body
→
17
←
The left operand of '==' is a garbage value due to array index out of bounds
173 n = __kernel_rem_pio2f(tx,y,e0,nx,2,two_over_pi);
174 if(hx<0) {y[0] = -y[0]; y[1] = -y[1]; return -n;}
175 return n;
176}