1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
// RUN: %clang_analyze_cc1 -verify %s -std=gnu99 \
// RUN: -analyzer-checker=core \
// RUN: -analyzer-checker=alpha.core \
// RUN: -analyzer-checker=unix \
// RUN: -analyzer-checker=alpha.unix
#include "Inputs/system-header-simulator.h"
typedef __typeof(sizeof(int)) size_t;
void *memset(void *__s, int __c, size_t __n);
void *malloc(size_t __size);
void free(void *__ptr);
// The store for 'a[1]' should not be removed mistakenly. SymbolicRegions may
// also be live roots.
void f14(int *a) {
int i;
a[1] = 1;
i = a[1];
if (i != 1) {
int *p = 0;
i = *p; // no-warning
}
}
void foo(void) {
int *x = malloc(sizeof(int));
memset(x, 0, sizeof(int));
int n = 1 / *x; // expected-warning {{Division by zero}}
free(x);
}
void bar(void) {
int *x = malloc(sizeof(int));
memset(x, 0, 1);
int n = 1 / *x; // no-warning
free(x);
}
void testConcreteNull(void) {
int *x = 0;
memset(x, 0, 1); // expected-warning {{Null pointer passed as 1st argument to memory set function}}
}
void testStackArray(void) {
char buf[13];
memset(buf, 0, 1); // no-warning
}
void testHeapSymbol(void) {
char *buf = (char *)malloc(13);
memset(buf, 0, 1); // no-warning
free(buf);
}
void testStackArrayOutOfBound(void) {
char buf[1];
memset(buf, 0, 1024);
// expected-warning@-1 {{Memory set function overflows the destination buffer}}
// expected-warning@-2 {{'memset' will always overflow; destination buffer has size 1, but size argument is 1024}}
}
void testHeapSymbolOutOfBound(void) {
char *buf = (char *)malloc(1);
memset(buf, 0, 1024);
// expected-warning@-1 {{Memory set function overflows the destination buffer}}
free(buf);
}
void testStackArraySameSize(void) {
char buf[1];
memset(buf, 0, sizeof(buf)); // no-warning
}
void testHeapSymbolSameSize(void) {
char *buf = (char *)malloc(1);
memset(buf, 0, 1); // no-warning
free(buf);
}
|
