1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89
|
// Refer issue 55019 for more details.
// A supplemental test case of pr22954.c for other functions modeled in
// the CStringChecker.
// RUN: %clang_analyze_cc1 %s -verify \
// RUN: -analyzer-checker=core \
// RUN: -analyzer-checker=unix \
// RUN: -analyzer-checker=debug.ExprInspection
#include "Inputs/system-header-simulator.h"
#include "Inputs/system-header-simulator-cxx.h"
void *malloc(size_t);
void free(void *);
struct mystruct {
void *ptr;
char arr[4];
};
void clang_analyzer_dump(const void *);
// CStringChecker::memsetAux
void fmemset() {
mystruct x;
x.ptr = malloc(1);
clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}
memset(x.arr, 0, sizeof(x.arr));
clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}
free(x.ptr); // no-leak-warning
}
// CStringChecker::evalCopyCommon
void fmemcpy() {
mystruct x;
x.ptr = malloc(1);
clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}
memcpy(x.arr, "hi", 2);
clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}
free(x.ptr); // no-leak-warning
}
// CStringChecker::evalStrcpyCommon
void fstrcpy() {
mystruct x;
x.ptr = malloc(1);
clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}
strcpy(x.arr, "hi");
clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}
free(x.ptr); // no-leak-warning
}
void fstrncpy() {
mystruct x;
x.ptr = malloc(1);
clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}
strncpy(x.arr, "hi", sizeof(x.arr));
clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}
free(x.ptr); // no-leak-warning
}
// CStringChecker::evalStrsep
void fstrsep() {
mystruct x;
x.ptr = malloc(1);
clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}
char *p = x.arr;
(void)strsep(&p, "x");
clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}
free(x.ptr); // no-leak-warning
}
// CStringChecker::evalStdCopyCommon
void fstdcopy() {
mystruct x;
x.ptr = new char;
clang_analyzer_dump(x.ptr); // expected-warning {{HeapSymRegion}}
const char *p = "x";
std::copy(p, p + 1, x.arr);
// FIXME: As we currently cannot know whether the copy overflows, the checker
// invalidates the entire `x` object. When the copy size through iterators
// can be correctly modeled, we can then update the verify direction from
// SymRegion to HeapSymRegion as this std::copy call never overflows and
// hence the pointer `x.ptr` shall not be invalidated.
clang_analyzer_dump(x.ptr); // expected-warning {{SymRegion}}
delete static_cast<char*>(x.ptr); // no-leak-warning
}
|