1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.security.ReturnPtrRange -analyzer-output text -verify %s
int conjure_index();
namespace test_element_index_lifetime {
int arr[10]; // expected-note{{Original object declared here}} expected-note{{Original object declared here}}
int *ptr;
int *test_global_ptr() {
do { // expected-note{{Loop condition is false. Exiting loop}}
int x = conjure_index();
ptr = arr + x; // expected-note{{Value assigned to 'ptr'}}
if (x != 20) // expected-note{{Assuming 'x' is equal to 20}}
// expected-note@-1{{Taking false branch}}
return arr; // no-warning
} while(0);
return ptr; // expected-warning{{Returned pointer value points outside the original object (potential buffer overflow) [alpha.security.ReturnPtrRange]}}
// expected-note@-1{{Returned pointer value points outside the original object (potential buffer overflow)}}
// expected-note@-2{{Original object 'arr' is an array of 10 'int' objects}}
}
int *test_local_ptr() {
int *local_ptr;
do { // expected-note{{Loop condition is false. Exiting loop}}
int x = conjure_index();
local_ptr = arr + x; // expected-note{{Value assigned to 'local_ptr'}}
if (x != 20) // expected-note{{Assuming 'x' is equal to 20}}
// expected-note@-1{{Taking false branch}}
return arr; // no-warning
} while(0);
return local_ptr; // expected-warning{{Returned pointer value points outside the original object (potential buffer overflow) [alpha.security.ReturnPtrRange]}}
// expected-note@-1{{Returned pointer value points outside the original object (potential buffer overflow)}}
// expected-note@-2{{Original object 'arr' is an array of 10 'int' objects}}
}
}
template <typename T, int N>
T* end(T (&arr)[N]) {
return arr + N; // no-warning, because we want to avoid false positives on returning the end() iterator of a container.
}
void get_end_of_array() {
static int arr[10];
end(arr);
}
template <int N>
class Iterable {
int buffer[N];
int *start, *finish;
public:
Iterable() : start(buffer), finish(buffer + N) {}
int* begin() { return start; }
int* end() { return finish; }
};
void use_iterable_object() {
Iterable<20> iter;
iter.end();
}
template <int N>
class BadIterable {
int buffer[N]; // expected-note{{Original object declared here}}
int *start, *finish;
public:
BadIterable() : start(buffer), finish(buffer + N) {} // expected-note{{Value assigned to 'iter.finish'}}
int* begin() { return start; }
int* end() { return finish + 1; } // expected-warning{{Returned pointer value points outside the original object}}
// expected-note@-1{{Returned pointer value points outside the original object}}
// expected-note@-2{{Original object 'buffer' is an array of 20 'int' objects, returned pointer points at index 21}}
};
void use_bad_iterable_object() {
BadIterable<20> iter; // expected-note{{Calling default constructor for 'BadIterable<20>'}}
// expected-note@-1{{Returning from default constructor for 'BadIterable<20>'}}
iter.end(); // expected-note{{Calling 'BadIterable::end'}}
}
int *test_idx_sym(int I) {
static int arr[10]; // expected-note{{Original object declared here}} expected-note{{'arr' initialized here}}
if (I != 11) // expected-note{{Assuming 'I' is equal to 11}}
// expected-note@-1{{Taking false branch}}
return arr;
return arr + I; // expected-warning{{Returned pointer value points outside the original object}}
// expected-note@-1{{Returned pointer value points outside the original object}}
// expected-note@-2{{Original object 'arr' is an array of 10 'int' objects, returned pointer points at index 11}}
}
namespace test_array_of_struct {
struct Data {
int A;
char *B;
};
Data DataArr[10]; // expected-note{{Original object declared here}}
Data *test_struct_array() {
int I = conjure_index();
if (I != 11) // expected-note{{Assuming 'I' is equal to 11}}
// expected-note@-1{{Taking false branch}}
return DataArr;
return DataArr + I; // expected-warning{{Returned pointer value points outside the original object}}
// expected-note@-1{{Returned pointer value points outside the original object}}
// expected-note@-2{{Original object 'DataArr' is an array of 10 'test_array_of_struct::Data' objects, returned pointer points at index 11}}
}
}
|
