为何GCC在-O2/O3优化级别下对这段C++代码报溢出警告？

问题背景 #

以下C++代码：

#include <algorithm>

char foo(char* buffer, unsigned int i, unsigned int buffer_size) {
    char c = 0;
    if (i == buffer_size) {
        std::copy(buffer + i, buffer + buffer_size, &c);
    }
    return c;
}

使用GCC以-O2或-O3选项编译时，触发如下警告：

In file included from /opt/compiler-explorer/gcc-13.2.0/include/c++/13.2.0/algorithm:60,
                 from <source>:1:
In static member function 'static _Up* std::__copy_move<_IsMove, true, std::random_access_iterator_tag>::__copy_m(_Tp*, _Tp*, _Up*) [with _Tp = char; _Up = char; bool _IsMove = false]',
    inlined from '_OI std::__copy_move_a2(_II, _II, _OI) [with bool _IsMove = false; _II = char*; _OI = char*]' at /opt/compiler-explorer/gcc-13.2.0/include/c++/13.2.0/bits/stl_algobase.h:506:30,
    inlined from '_OI std::__copy_move_a1(_II, _II, _OI) [with bool _IsMove = false; _II = char*; _OI = char*]' at /opt/compiler-explorer/gcc-13.2.0/include/c++/13.2.0/bits/stl_algobase.h:533:42,
    inlined from '_OI std::__copy_move_a(_II, _II, _OI) [with bool _IsMove = false; _II = char*; _OI = char*]' at /opt/compiler-explorer/gcc-13.2.0/include/c++/13.2.0/bits/stl_algobase.h:540:31,
    inlined from '_OI std::copy(_II, _II, _OI) [with _II = char*; _OI = char*]' at /opt/compiler-explorer/gcc-13.2.0/include/c++/13.2.0/bits/stl_algobase.h:633:7,
    inlined from 'char foo(char*, unsigned int, unsigned int)' at <source>:6:12:
/opt/compiler-explorer/gcc-13.2.0/include/c++/13.2.0/bits/stl_algobase.h:437:30: warning: 'void* __builtin_memcpy(void*, const void*, long unsigned int)' writing between 2 and 4294967295 bytes into a region of size 1 [-Wstringop-overflow=]
  437 |             __builtin_memmove(__result, __first, sizeof(_Tp) * _Num);
      |             ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<source>: In function 'char foo(char*, unsigned int, unsigned int)':
<source>:4:14: note: destination object 'c' of size 1
    4 |         char c = 0;
      |              ^

疑问：当i == buffer_size时，std::copy的起始和结束迭代器指向同一位置，理论上不会执行任何复制操作，为何会触发溢出警告？

原因解析 #

这是GCC高优化等级下的无符号整数运算推导偏差导致的误报：

• 当i == buffer_size时，buffer + i与buffer + buffer_size确实指向同一地址，但GCC处理无符号整数时，会将元素数量buffer_size - i视为无符号值。虽然实际值为0，但在高优化的内联分析流程中，编译器没有正确关联if (i == buffer_size)的前置约束，反而错误将该值推导为无符号下溢后的极大值（接近UINT_MAX）。
• 针对char*这类随机访问迭代器，std::copy会调用__builtin_memmove，复制字节数计算为sizeof(char) * _Num，当_Num被推导为极大值时，编译器判定目标c的1字节空间远不足以容纳写入，从而触发溢出警告。
• -O2/-O3等级下的多层函数内联，进一步干扰了静态分析的上下文关联，导致编译器无法识别当前分支下std::copy的实际无操作逻辑。

解决方法 #

• 直接移除冗余的std::copy调用：既然i == buffer_size时没有元素需要复制，该分支内无需执行任何操作。
• 显式添加元素数量判断，帮助编译器识别无操作场景：

if (i == buffer_size) {
    unsigned int count = buffer_size - i;
    if (count > 0) {
        std::copy(buffer + i, buffer + buffer_size, &c);
    }
}

内容的提问来源于stack exchange，提问作者eyelash