1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196
|
// RUN: %clang_analyze_cc1 -Wno-array-bounds -analyzer-checker=core,alpha.security.ArrayBoundV2,debug.ExprInspection -verify %s
void clang_analyzer_eval(int);
// Tests doing an out-of-bounds access after the end of an array using:
// - constant integer index
// - constant integer size for buffer
void test1(int x) {
int buf[100];
buf[100] = 1; // expected-warning{{Out of bound access to memory}}
}
void test1_ok(int x) {
int buf[100];
buf[99] = 1; // no-warning
}
const char test1_strings_underrun(int x) {
const char *mystr = "mary had a little lamb";
return mystr[-1]; // expected-warning{{Out of bound access to memory}}
}
const char test1_strings_overrun(int x) {
const char *mystr = "mary had a little lamb";
return mystr[1000]; // expected-warning{{Out of bound access to memory}}
}
const char test1_strings_ok(int x) {
const char *mystr = "mary had a little lamb";
return mystr[5]; // no-warning
}
// Tests doing an out-of-bounds access after the end of an array using:
// - indirect pointer to buffer
// - constant integer index
// - constant integer size for buffer
void test1_ptr(int x) {
int buf[100];
int *p = buf;
p[101] = 1; // expected-warning{{Out of bound access to memory}}
}
void test1_ptr_ok(int x) {
int buf[100];
int *p = buf;
p[99] = 1; // no-warning
}
// Tests doing an out-of-bounds access before the start of an array using:
// - indirect pointer to buffer, manipulated using simple pointer arithmetic
// - constant integer index
// - constant integer size for buffer
void test1_ptr_arith(int x) {
int buf[100];
int *p = buf;
p = p + 100;
p[0] = 1; // expected-warning{{Out of bound access to memory}}
}
void test1_ptr_arith_ok(int x) {
int buf[100];
int *p = buf;
p = p + 99;
p[0] = 1; // no-warning
}
void test1_ptr_arith_bad(int x) {
int buf[100];
int *p = buf;
p = p + 99;
p[1] = 1; // expected-warning{{Out of bound access to memory}}
}
void test1_ptr_arith_ok2(int x) {
int buf[100];
int *p = buf;
p = p + 99;
p[-1] = 1; // no-warning
}
// Tests doing an out-of-bounds access before the start of an array using:
// - constant integer index
// - constant integer size for buffer
void test2(int x) {
int buf[100];
buf[-1] = 1; // expected-warning{{Out of bound access to memory}}
}
// Tests doing an out-of-bounds access before the start of an array using:
// - indirect pointer to buffer
// - constant integer index
// - constant integer size for buffer
void test2_ptr(int x) {
int buf[100];
int *p = buf;
p[-1] = 1; // expected-warning{{Out of bound access to memory}}
}
// Tests doing an out-of-bounds access before the start of an array using:
// - indirect pointer to buffer, manipulated using simple pointer arithmetic
// - constant integer index
// - constant integer size for buffer
void test2_ptr_arith(int x) {
int buf[100];
int *p = buf;
--p;
p[0] = 1; // expected-warning {{Out of bound access to memory preceding}}
}
// Tests doing an out-of-bounds access before the start of a multi-dimensional
// array using:
// - constant integer indices
// - constant integer sizes for the array
void test2_multi(int x) {
int buf[100][100];
buf[0][-1] = 1; // expected-warning{{Out of bound access to memory}}
}
// Tests doing an out-of-bounds access before the start of a multi-dimensional
// array using:
// - constant integer indices
// - constant integer sizes for the array
void test2_multi_b(int x) {
int buf[100][100];
buf[-1][0] = 1; // expected-warning{{Out of bound access to memory}}
}
void test2_multi_ok(int x) {
int buf[100][100];
buf[0][0] = 1; // no-warning
}
void test3(int x) {
int buf[100];
if (x < 0)
buf[x] = 1; // expected-warning{{Out of bound access to memory}}
}
void test4(int x) {
int buf[100];
if (x > 99)
buf[x] = 1; // expected-warning{{Out of bound access to memory}}
}
void test_assume_after_access(unsigned long x) {
int buf[100];
buf[x] = 1;
clang_analyzer_eval(x <= 99); // expected-warning{{TRUE}}
}
// Don't warn when indexing below the start of a symbolic region's whose
// base extent we don't know.
int *get_symbolic(void);
void test_underflow_symbolic(void) {
int *buf = get_symbolic();
buf[-1] = 0; // no-warning;
}
// But warn if we understand the internal memory layout of a symbolic region.
typedef struct {
int id;
char name[256];
} user_t;
user_t *get_symbolic_user(void);
char test_underflow_symbolic_2() {
user_t *user = get_symbolic_user();
return user->name[-1]; // expected-warning{{Out of bound access to memory}}
}
void test_incomplete_struct(void) {
extern struct incomplete incomplete;
int *p = (int *)&incomplete;
p[1] = 42; // no-warning
}
void test_extern_void(void) {
extern void v;
int *p = (int *)&v;
p[1] = 42; // no-warning
}
void test_assume_after_access2(unsigned long x) {
char buf[100];
buf[x] = 1;
clang_analyzer_eval(x <= 99); // expected-warning{{TRUE}}
}
struct incomplete;
char test_comparison_with_extent_symbol(struct incomplete *p) {
// Previously this was reported as a (false positive) overflow error because
// the extent symbol of the area pointed by `p` was an unsigned and the '-1'
// was converted to its type by `evalBinOpNN`.
return ((char *)p)[-1]; // no-warning
}
|