1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
// RUN: %clang_analyze_cc1 -analyzer-checker=core,unix.Malloc -verify %s
typedef __typeof(sizeof(int)) size_t;
void* malloc(size_t size);
void *calloc(size_t num, size_t size);
void free(void * ptr);
void escape(void *);
void next_statement();
void conditional_malloc(bool coin) {
static int *p;
if (coin) {
p = (int *)malloc(sizeof(int));
}
p = 0; // Pointee of 'p' dies, which is recognized at the next statement.
next_statement(); // expected-warning {{Potential memory leak}}
}
void malloc_twice() {
static int *p;
p = (int *)malloc(sizeof(int));
next_statement();
p = (int *)malloc(sizeof(int));
next_statement(); // expected-warning {{Potential memory leak}}
p = 0;
next_statement(); // expected-warning {{Potential memory leak}}
}
void malloc_escape() {
static int *p;
p = (int *)malloc(sizeof(int));
escape(p); // no-leak
p = 0; // no-leak
}
void free_whatever_escaped();
void malloc_escape_reversed() {
static int *p;
escape(&p);
p = (int *)malloc(sizeof(int));
free_whatever_escaped();
p = 0; // FIXME: We should not report a leak here.
next_statement(); // expected-warning {{Potential memory leak}}
}
int *malloc_return_static() {
static int *p = (int *)malloc(sizeof(int));
return p; // no-leak
}
int malloc_unreachable(int rng) {
// 'p' does not escape and never freed :(
static int *p;
// For the second invocation of this function, we leak the previous pointer.
// FIXME: We should catch this at some point.
p = (int *)malloc(sizeof(int));
*p = 0;
if (rng > 0)
*p = rng;
return *p; // FIXME: We just leaked 'p'. We should warn about this.
}
void malloc_cond(bool cond) {
static int *p;
if (cond) {
p = (int*)malloc(sizeof(int));
free_whatever_escaped();
p = 0; // FIXME: We should not report a leak here.
next_statement(); // expected-warning {{Potential memory leak}}
}
escape(&p);
}
|
